alanorth/ansible-personal
1
0
Fork 0
Code Issues 4 Pull Requests Projects Releases Wiki Activity

Compare commits

base: alanorth:8f50b7756b4660ee901118b3f54757482c604b57
Branches Tags
alanorth:master alanorth:alpine
..
compare: alanorth:master
Branches Tags
alanorth:master alanorth:alpine

56 Commits
8f50b7756b ... master

Author SHA1 Message Date
Alan Orth
73fd06fe3a roles/common: remove cron-apt 
Use unattended-upgrades instead. It has sane defaults on Debian at
least (I haven't checked Ubuntu).
 2025-04-07 09:51:09 +03:00
Alan Orth
88cb3a370e Remove logic for Ubuntu 20.04 and Debian 11 2025-03-29 23:09:44 +03:00
Alan Orth
027a43ddbe roles/caddy: use default for encode 2025-03-29 22:49:30 +03:00
Alan Orth
bb30c3be20 host_vars/web22: update vhosts 2025-03-29 22:48:19 +03:00
Alan Orth
d8d9790d21 roles/nginx: enable nginx ssl_session_tickets 
This has apparently been supported since nginx 1.23.2 and is safe
to use the default (on) now.

See: https://github.com/mozilla/server-side-tls/issues/284
 2025-03-29 22:35:56 +03:00
Alan Orth
9a500ebc0d roles/nginx: disable nginx ssl_prefer_server_ciphers 
This is apparently the default and recommended by Mozilla's server-
side SSL configurator also recommends. This lets the client choose
the ciphers best for them (and the ciphers in TLS 1.2 and 1.3 are
not currently known to be dangerous).
 2025-03-29 22:34:41 +03:00
Alan Orth
4bae942585 roles/nginx: add nginx ssl_ecdh_curve 
This seems to be new since I last looked at the Mozilla server-side
SSL configurator.
 2025-03-29 22:34:37 +03:00
Alan Orth
99866c0c90 roles/nginx: use one day for nginx ssl_session_timeout 
This is a new default since I last looked at the Mozilla server-side
SSL configurator.
 2025-03-29 22:34:32 +03:00
Alan Orth
0afb8a4493 roles/nginx: update nginx ssl_buffer_size 
The old default has not been changed in eight years and I see that
there have been some discussions over the years about this. I will
change this from the slightly extreme 1400 bytes to 4k (nginx def-
ault is still 16k so this is more "optimal" for HTML/CSS content).

See: https://github.com/igrigorik/istlsfastyet.com/issues/63
 2025-03-29 22:34:27 +03:00
Alan Orth
506695da31 roles/nginx/defaults: update version comments 2025-03-29 22:24:49 +03:00
Alan Orth
f67ed7762c roles/nginx: fix http2 syntax 2025-03-29 22:20:49 +03:00
Alan Orth
014f4d9502 roles/nginx: add newline 2025-03-29 22:19:41 +03:00
Alan Orth
22c16e1ed3 roles/caddy/templates: closer to supporting WordPress 
I still wouldn't want to deploy WordPress on Caddy until it's more
obvious and standard to block paths that shouldn't be accessible.
It seems that this is still left as an exercise to the site admin.

This discussion has some tips, but it is four years old and hasn't
changed since I last looked.

See: https://caddy.community/t/using-caddy-to-harden-wordpress/13575
 2025-03-29 22:09:37 +03:00
Alan Orth
5aa6a33e51 roles/php-fpm: set user and group based on webserver 
We use either caddy or nginx, which are conveniently named the same
as the Unix user and group.
 2025-03-29 21:01:56 +03:00
Alan Orth
7f9b06af9c roles/nginx: smarter setting of document root 2025-03-29 19:34:53 +03:00
Alan Orth
84db337fea roles/caddy: smarter setting of document root 2025-03-29 19:33:02 +03:00
Alan Orth
7b23f5f94f roles/caddy: add missing tag 2025-03-29 19:16:03 +03:00
Alan Orth
9830338be3 Use one default root prefix for nginx and caddy 2025-03-29 19:15:56 +03:00
Alan Orth
e3eed26765 roles/caddy: update vhost template 2025-03-29 18:37:28 +03:00
Alan Orth
8b31c7e148 host_vars/web22: WordPress 6.7.2 2025-03-29 16:10:23 +03:00
Alan Orth
3ff8043aaf Pipfile.lock: run pipenv update 2025-03-29 15:30:08 +03:00
Alan Orth
cb79f7ef70 roles/common: minor change to firehol update script 
They include bogons like 127.0.0.1 that should not be routed on the
public Internet, but this blocks local applications we proxy to.
 2025-01-28 09:14:48 +03:00
Alan Orth
bb14f05d2a roles/common: use Ansible timezone module 
No need to use a command for that. The module does it better because
it doesn't register a change unless the timezone changes.
 2025-01-27 23:11:56 +03:00
Alan Orth
5b1530fa91 roles/common: rework firewall 
Use firehol instead of all the others. AbuseIPDB.com can't be upd-
ated automatically, Abuse.ch is no longer maintained, and Spamhaus
is already in firehol.
 2025-01-27 23:05:45 +03:00
Alan Orth
5312dc6bd5 roles/common: use common nftables task 
Use a common nftables task on Debian and Ubuntu.
 2025-01-27 23:05:38 +03:00
Alan Orth
d6e060d3af roles/common: simplify firewall tasks 
Apply firewall tag to included tasks, then we don't need to use a
block.
 2025-01-27 22:30:50 +03:00
Alan Orth
b873af004a roles/common: single firewall task include 
Use one include from the main tasks file.
 2025-01-27 22:28:27 +03:00
Alan Orth
7ea3ab46f8 host_vars/web22: WordPress 6.7.1 2025-01-27 21:48:16 +03:00
Alan Orth
0561bd5b52 Pipfile.lock: run pipenv update 2025-01-27 21:36:13 +03:00
Alan Orth
d62572f02c Pipfile: python 3.13 2025-01-27 21:35:58 +03:00
Alan Orth
2ffe5e87d9 host_vars/web22: WordPress 6.6.2 2024-12-30 11:03:47 +03:00
Alan Orth
38d4f1a303 Pipfile.lock: run pipenv update 2024-12-30 11:03:35 +03:00
Alan Orth
ed8cb88038 host_vars/web22: WordPress 6.5.5 2024-06-25 08:18:22 +03:00
Alan Orth
c31e447861 roles/nginx: update signing key 2024-06-25 08:11:59 +03:00
Alan Orth
545684467c host_vars/nomad03: remove 2024-06-05 20:35:29 +03:00
Alan Orth
24ae5eaab1 host_vars/web22: WordPress 6.5.3 2024-05-13 14:51:45 +03:00
Alan Orth
dac23f1427 Pipfile: use Python 3.12 2024-05-13 14:51:34 +03:00
Alan Orth
41fbc73dd1 host_vars/web22: WordPress 6.4.3 2024-03-20 20:28:13 +03:00
Alan Orth
fee794bcf0 Update Pipfile 2024-03-20 20:28:00 +03:00
Alan Orth
8bce1d8b1b host_vars/web22: WordPress 6.4.1 2023-12-02 22:40:06 +03:00
Alan Orth
6dc2ea36b6 roles/nginx: fix path to php 8.2 socket 2023-09-11 19:55:24 +03:00
Alan Orth
af71a9b5f8 roles/php-fpm: remove fmt strings 
Ansible confuses them for jinja2 tokens.
 2023-09-11 19:52:18 +03:00
Alan Orth
4dd57803e2 roles/php-fpm: fix user/group for php 8.2 configs 2023-09-11 19:51:59 +03:00
Alan Orth
18d4245fc0 roles/common: fix tarsnap signing of apt repo 2023-09-11 19:37:49 +03:00
Alan Orth
1bddf3cccd Pipfile.lock: run pipenv update 2023-09-11 18:52:25 +03:00
Alan Orth
20dbe61fe1 roles/mariadb: use MariaDB 10.11 
The server has already been updated from 10.6 to 10.11.

See: https://mariadb.com/kb/en/upgrading-from-mariadb-10-6-to-mariadb-10-11/
 2023-09-10 22:53:10 +03:00
Alan Orth
899e87321b host_vars/web22: WordPress 6.3.1 2023-09-10 22:44:23 +03:00
Alan Orth
06416a3b64 roles: run ansible-lint --write 2023-08-23 22:22:51 +03:00
Alan Orth
7a9a24ef5d roles/common: rework fail2ban again 
Actually, we do want to run fail2ban on all hosts because the sshd
monitoring via systemd is nice. At the very least it reduces spam
from failed logins in our systemd journal.
 2023-08-23 22:15:24 +03:00
Alan Orth
067adcd9f5 roles/common: rework fail2ban tasks 
We can only run fail2ban when we have logs to monitor. When a host
is running Caddy we don't have logs, so fail2ban doesn't have any-
thing to monitor out of the box. For now I will restrict the task
to hosts running nginx.
 2023-08-23 21:59:28 +03:00
Alan Orth
84d210cfab roles/common: re-format handlers 
Use the newer Ansible format.
 2023-08-23 21:35:28 +03:00
Alan Orth
17736a4f14 roles/common: run ansible-lint --write 2023-08-23 21:33:22 +03:00
Alan Orth
b9e91c4a3d roles/common: minor updates to tarsnap task 
Use modern Ansible task format
 2023-08-23 21:20:22 +03:00
Alan Orth
51c95e5d4c roles/common: update tarsnap task 
Update tarsnap task to use apt signed-by for package signing keys
instead of adding keys directly to apt-key.
 2023-08-23 21:18:27 +03:00
Alan Orth
8dbec29d2a roles/nginx: prepare letsencrypt task for Debian 12 2023-08-23 21:01:12 +03:00
Alan Orth
d3bf3dab04 roles/php-fpm: add support for PHP 8.2 
This is used in Debian 12.
 2023-08-23 20:56:35 +03:00
56 changed files with 1607 additions and 11995 deletions
Expand all files Collapse all files

2
Pipfile
View File

@ -10,4 +10,4 @@ ansible = "*"
ansible-lint = "*" ansible-lint = "*"
[requires] [requires]
python_version = "3.10" python_version = "3.13"

1055
Pipfile.lock generated
View File

File diff suppressed because it is too large Load Diff

2
README.md
View File

@ -4,7 +4,7 @@ Ansible playbook for base and initial configuration of the web server hosting my
## Assumptions ## Assumptions
Before you can run this, a few things are assumed: Before you can run this, a few things are assumed:
- You have a clean, minimal Ubuntu 20.04 or Debian 11/12 host up and running - You have a clean, minimal Debian 12 host up and running
- Python 3 is installed on the remote server (requirement of Ansible) - Python 3 is installed on the remote server (requirement of Ansible)
- You have a user account with password-less SSH access to the machine - You have a user account with password-less SSH access to the machine
- You have sudo privileges on the remote host - You have sudo privileges on the remote host

3
group_vars/web
View File

@ -8,4 +8,7 @@ webserver: nginx
extra_fail2ban_filters: extra_fail2ban_filters:
- nginx - nginx
# root prefix for all web servers
web_root_prefix: /var/www
# vim: set ts=2 sw=2: # vim: set ts=2 sw=2:

88
host_vars/nomad03
View File

@ -1,88 +0,0 @@
$ANSIBLE_VAULT;1.1;AES256
30626135313830363339656165316536336564353362383439346465373932326136363337343762
3566343231306635313739303335616162396232303139620a323764663132323135663063393334
62656434643333663062356266626235363439393231333734343432333363643934393636373935
6332353333303231370a373839636135363730636539326335343533316633623366663230353262
37396264313763366438663139376638613337336634393665663032623035646631653564353966
30353165333638363864656531396165363430653438376465656233306639353336353237343532
62363330333662316630656662633333626462363062366637386163336230386634353933316238
36373365323735373435616262613933333964323033633233333766396362616534316166386432
31333831353130616166633735366131653137363361313333363763623364303435346338643838
63323831616135643830653839323663386239343430356437346665343937306666333836363163
37386663616136653861663530383865343930306263663366633438363332336561326330353235
64613332643962323930323436393934636263396239366364306136303437323739343237656263
33613964363139363862396235636435626432326432663166633765613635666165363165663539
62366232316632356233326564633737643466343535656564653833623766373637313833373331
38356336396461666535386363633437376232396330623162333936366434376361326261343336
35396237346663646334306663306633383061353333643639613335643661633835313732353963
64623234373033656366613566363639663762646663396462323361363463373961383530653962
61613962316336653266383638393630323338383161303565333862633932646463313134613232
31326262336561383066633430383833353835373363623163303830663837313265663662313862
39353062333234663631653565613135396337626664626264366534633566386236393562303861
66316335343638356261396339353932633331356363343231363862333066366438323764633331
39316236343262666337303839356138666338306130323462646633373464646163613734366132
37623739333435396266316131383238323365646632636339353631376166613532386133393165
64633933393062623230346430653961646366316662356336646162313466393964323332616431
34336562343337636138616431313736613539373137303666666435373238346233383438383963
39346138393635626263376137643436393736636435393234646439353932386136653034393961
65336230356336386539386334653236303964623632323738383333623361643235656530363731
39306538353533663538366362613739386463336632653665636533616462363530636466626165
32623762616266623231393938663931306231626139663736613862363234643861366563633532
31393934333433316138323131373836306135333061363231363461643933303836633231343266
37323732383036326664376438343261333733636532303664613965353561376337633564373062
64316133333263393138333261323062626363343765393161363935386232353862353762626334
31346661303239383832343637376663316537353938346534306134626534363438386162653133
66616237663864633837356132663139633734303532653637366138386534653462323163313836
34633337643661656465653839316362633236633833646632393930656136313730646566316537
39653935633636363635386435373062333031356363633661366530616537356533323133366339
34336139323138336532313833633364363566613833636339396462326530313961613133613761
63356231313363303862663032373663626262646565353933663963363633363663373238656632
31393264333732366565376164623766663162386365356233383132303835643932386436333631
65663334336434663562326238326338376662303339616233616464313139363864623463613761
36326235396433633435366263393964383936616433653861326431343133346435663832363437
33333232636536363863373037616436313335393639393966653062303330366463323861376661
39383665316665303363636331373461623339323031393333323465313733336236303037313132
37613163373432316132306235343061393530366237626134323431323836316261326237323965
33643662663361356164653430323566666230656561633434333538303365663334373537306164
65633264323836656537623766316533386564663765376661663537303835393438623430343263
64353031633436343938383263313439383033326532313466653766616164653463333434353664
30653034353632373561346565616631656235323637333562613538663538363936663464383064
31336365613037626331363731376663653537613639313839303934633462666430306635613434
65333736653430363936663566666535346231383563366630653535313038383964326630616264
63616563356361313439303833646438386163313865356634636536336661626664316163333739
63303465643861656362386530353363383836396534373461663630636461633336333862353830
38666536353663386466313066376562383366643062343965386132666435376433626165353735
61666432613133646130373839336261333565303532643164306264633736346637373835393266
33306133346531333835303238393361663463346162636161646565313266616133623735653838
62396531313634343936363861373031383830636538376334316161326364303930383435653936
36653233343935646337376232396638343033613130663563326135633231636362373162623565
39323762623966393332376235643666383461356263346332663939616235346564636233333463
35356161616536613939313436616233386563343764643335653961643366656632646338313536
35323732333539326239386436306230646230663336623566633763383534626162386463613961
62353737363435653866383633343830356536633462373636323734656231636466336235306162
62666133656166633838363262613930396236393862306438316135643131393737363531373631
31626635613233313063326463663738393632373135373632323731396332323138633962356364
39396565393038623532313230383539656564383134363161393663373539393837313335303636
38626138613932643265643231366364373964623436663566623838643939323331646661653435
37373765393736303861346164373938393532636637353737326539333435666562643664363365
65646662626630663238336264663665663762666439626336376434386436653965363832346339
30396630343430323762666232366336376563616430643136336630373864623132386465393761
66396439346563393539616335383562633237353962383033356230323339353336343964366134
38623661326336376561633937613565386164656462313863336339643733663834373732643266
61666438666635656236376239393433306239613936613731636235353638396432326438396432
63333237333633333761666630663339613232313136316232346234363562333937363463333137
39653336343732303536616662643961623932643330653936343337316135366535363964616439
37376433326332386339363961656537326632333830346435353234333661636434343730356139
37346131303930306364623334313335323563333631653539383637376433623439386564633035
38346436376661333233663334623762646633346530643466336664386134353662363430316438
63393333333034623537303030353136633035353865383366613961373766646463366131623564
34646630666233333834383761363566373935333037633666336261313566613762616531653739
34643162323438646165643433333438656664383232376233306233623539366233633337663565
35323636633533343064376434666435666564666134343839653630326236343262633431326133
36663432396666306631613162643065313135373332303863326234356537366436333938303637
36636334396231316564643733646662376138313637643232373836373632643362383363363530
32363736646162303532356132373337616162636464643164323432623338363463663736373433
34343136646339376132383434623261356163393032306134633665323130623766333738656639
64306632346162396533316431343339366664333335643464386266376464393039633439653837
36303363326239316663346434613336636239653331626661393962356166383339333234376135
653361363631363366323165353538313438

276
host_vars/web22
View File

@ -1,137 +1,141 @@
$ANSIBLE_VAULT;1.1;AES256 $ANSIBLE_VAULT;1.1;AES256
63356538383464316265363339393262623161313332333136363039613462393065323039333839 64313136396662396631396561646634386134313337316166376264346466386533383934393130
3437666230393631643932373532646537376132643736310a376432616165386434306637356530 6339663736653462613737323932396664643132383036370a343032653931343063326337626336
34643036663438363264346130653636623930643462343566313365393161623033663632376331 38383332346637633636663865333031636166643161323335363663653033646234656332333462
3934336365366334620a613436336239303131353165663562343865336631303433656630636266 3833643037313134320a613332303261356363363138636138323661633233353365623665663632
36366433623938643932643765393238653935623861303939326637306439313039613566396336 30616166383161663534666337303632663532343866366261393935373935666536616530373862
35666638396239356630353762356463353137393462336532643930343366336233343730656334 66653836393966346463393061646431336666316537613364643939663938303135386463616661
32373335623539333339666662633965363061613434366463613239353466333462646234643635 31633330663364353663646338386338323039646530373165386663646235303963623837646533
34383866623936396437396361363761363337326539393439663830303663643163636137656565 30316236313736303837353536633161326564643566643533363431303130376338383034623365
64633961373835373739666162643233373036656134303863316166323061663362626431323331 34303861356264333463613739373635616363366362333738383838326162313238313966313765
33643763363563373332613131363166616432376230356636623530313463636337363235626532 35356637623833663437373765333237323961383133336161363439316632363634623734373962
61343465656534623965636638303032363261613430343030656330653239656465386434383234 32326466303536363164666532313264343661336364396562383630653865316132366538313066
31636336343162616134333536373632353733373136356165313662623063306661306131646533 65666661343632383434346639353462623735373933303263613938363635353666656139663832
37626138393035613864316539396338386563333338633834356334313766346161363130313231 66333638636136393166636332623934613938656336663431323032333339336165366664636334
66336131323931633963653464636361653739623537616563663533313734343666623237333036 65363166616462303939383838363363623530313539386635313664333136643035623262663333
39616564333334366361356135353132363033323461383166663531306135626135353766343361 35643335346639623363323535633735613965333133323639383339323166366635303536376265
33393939333532363465383632353031383065353830643038303665613430313334343630616566 35613939376135393165653466366462656162353632393139376666666334386166366162643438
38663963356631613234623435636361333935613964626330636331346432663733303561336166 31313033353661313031303961313032613539396561303734356533373234633233613465306431
31633436363438373966666431366232323136356139643333393363323232363261356433353333 31303332643931333037343164643162663738393466346639306632306534613065376138323564
31336332623038323130303938356131396131386335646466366263346530616439363539306165 31326462666336633938396230666231356439343630336132313064363636333563373637313666
37343834656333343034653435323934623462333330613764336361323535663563653835643535 32303230616235653733323032343238303230396232623364643765613764336137646630363462
61386630306465353037386531353263656238333461313063626164343231303163663030363165 64343239343530636333663764643338623630366163636232353734616333306339626136313338
32653332383931653535663266393631373236643236616432303166646634363637346539626263 35616632326436663734376263366437356236343339663430323632646136373066373961666135
36396666653730333962366265663334323765623137643130653335613861313163656339663263 38313838316266313830626234366262383037646661386537663534633263633239306461346535
64303261353062376536343830353236653163386339373534323934343861323231303733303733 32643032316266373931346232356162336437623137623365616132643731666361313637316536
62393439626566373230383734396137346436623932363564383030626638643330666264306564 39656332383466346236633461366437386538373734646337393666346562323139663734326436
63656236356535613362346137653438623765656437313137666365346464326161646262346136 65623633363266323563666437633666326363626561313133633031623632633333346332623334
65636363316530346130343237383161643539616536373266343865323832343634623761616335 31396365333336313939633161613639383963633136616562333236636666306139663430363265
39626632373865313661316335336130303462383266623135646437643736616561326266396332 63353261306332346439313534393363626638633531633532363365663265353331336231316238
35663339326531626366376530326134303363343930656539326433366662393662653764323133 37323439383930346136383036303833316565306139613235333633373832313130316534666435
34643364343637383930353036613339393639363534663938623966633833346666616536616134 30323262623037623939336265303866356532653064303436653131633162616630326362616430
63643031383464663139313066656335623164636666346265396564626665653935333833353730 33343538353139326663653735343436623834653264376264363761313835376433653531623266
63393062363439303435623663363331343732656563663233366630646163323564666437346566 34386266613733653634363135616335303138303062316664623666643263323939643939303133
61303736653536663662326430366330313239353535613135663336653334316435323262396634 32393564323833666132626664646436333733396565623164646363343065343464363465383330
36313761613836353937356665346135633162653239383033613438356435313234373638656339 33636562613734303665343366656630303732323739363339306337316266356635323262643031
33366462613432346533663231313535333665646635333436343237373935373838376533363165 63393261363764613638666231663837373263353137643265336134646364343130353237336463
63303735663564333732363363393038636531653264613965666235333331623663346534366566 62306363373339363235343034393230623035373366656531666663323936323366643938646135
33333764356665363638616561656537613039626631363066316133623963626338343231616361 62643135383734663766353230356463373337613936633037396538643365393738363234313166
34373266313863663831363639663439643936303931666532653962323733366635653035646664 62303038326236656332663939333364633132386266383665363632386235643731616631313431
32666239663062316437313737346161376562663630636466623431386266363263623633373963 37613566616463613662633734316461386261646464636539353439373431323133663435333763
35666665383738656437313438303832326137343033633562666436303535613538343832613839 63333230663431323136373564613239386531356463646366313537303861616234626561663133
35383330613538383164353233336335376266343336616430303638363365613065393262356435 32643134666337633938633530323034653131663663643732623636633834323064633832396339
30346537616335316661333533363763393633616438633066316232623738366230646364353735 35613738366666653765333434616336383635323765626561376232363062373761383665313735
38386236316539343063633765386235663866323433666531613666646365376330333539376562 30643165633930656566633339383439353931303836333537343634353434653433333933386338
66653762633630366638323334393132383635373663343830653431363534353961303139373734 64393566616166353731313261386239646531316563623363646537653964366631663266353366
38346438663966363166363464393863393861643936333536343035626239326238363131343966 65666638393337663633366132663933376135396334303461653232353765626365303464626338
64646435663863303937646364616630633266326237326330323733396165663134383432343862 30653334393439373632393662653032633264363238626431326136653561636164646237373033
39666238346336353531653165313066343039653430373833323832326631386430326435646530 32646464616137366163313634623864656666346336383037373562633333633432313439323631
33343233353331626533383864303235366538663338376465316161653664386361373761376134 34646132643834323261316166303531666238333964396165313936393937366533396436633832
65333437306165346331376664646161616230316530373630383965333434313937333637393530 34663538613139623063346666306165306530646363353732353431343831303161343535623539
39373334653164646233323064623431313832313662313832613837646561373534623535656239 38663537323132653034393335623232623530343432336531643538356430636262313132356430
31663939616634613235386564333962626333616164326466656163376362346437396532616238 33363062333931306633643733313239373934313635336465643139616266613237353166626334
65656138323430633137373030376661653231303237396331333839626365376533313038316132 35643138633561393531313835623665303531313437323664616561633764316332393435373065
35623464323934616361663164323137316135326566393339316161666437343238333031633832 38633766623633666362633336326466343938623461393736666137313965386133396433303236
34356561333565623532656332353463343430336531383364383733323664383365356263393539 34366339326637323934323236346239373565623565313433376433303061353763383732663239
33666332623665343336353365396163386334613232663962663131383734353762396466313464 65313636646539623037653761316662303565636262376262333332316136623737613338303036
61396265333037636232323738373462313638663033343437376431656464636137306661636561 37623837313636333464626664323163633136343762306462323339646535636237326138613132
39646537393131613539633032616338333265386562326532636136303039383034626465373139 33613761646237396265616135346639636566316633646165616332656333383233343836316163
66636363316461643537356439303861356439656661643663653335383565616532623435383634 36313736343263343534656533646463343933333031666433393635623461633639356430303434
66313436366663656464643061643531633161626635643235633930353339386663346232366235 34663033333933333439386532623664316364343066646232353335643536353733326165623231
62386161323934343730646439353163663538633562626232323333373839363430323239366131 66306661343939616235313238353761643034623062326632393161336462333365636536343934
62343832346235643863353134636261616262386364623236643966333636323637646532333634 63343866666237636563363561366339623161643362326632333532613562336238653562346231
33643932656165383031303931383634623231663335613035316537373731323963376565333962 33623337386233636331326232393465346362336439303336303638643430623864323434633333
34363939616334326134363661633833386433373430363766383461663136376466306661386639 63623036623764646234636433383364333763613866626230316533643535356662306136346664
64343236393738326339663963396635393739623232313463333063653133343461633564393735 36353734663866306336303439623537336266383131303365383439356462306237363030306432
61353562626362383432636430343062643166353035633232613035636634383064663734633934 38623738643434396138373837386334616435383662363032663930363038666536653334613261
65633430613138643837346535623865613931383338306663633466343932393837333333313836 36623730666333393564346539653533656434346439346632643730356665313865396463343737
61346163316630353133616661346133346239623763303262373637303030336639643563646665 31326633646661666461396365643061333361643638363835343235646231633637616464343265
35646462643531356635376331303565663630356161323565333737363462666161633761623431 36646439383737336531303236666136313063653563653433306563643362353536663863653266
63666161353639393734613631396566336137333830653531643436623462316535333537666365 38613461363432333666343264333461396461653231646133383861363763353763626334373635
36643662353664383233613131643761346433356265333761326361303439326535396438613061 35313431346465336636363531363766633234653066376366636263306238393361343936663066
63633335326339323437316331613033643934323238663636636431653632363165666232363631 61653739303230316232626335383865636235363638663463396435623737616661346666613037
35363231363165306236326662656166373739373761316466353663393836336631326465646265 32666436333937356530326566626237303065363834313837383837306432383833643632376564
66363766663333333765653032366161363437383735646664633635306562323363343863643936 39623937653631656562306565376232333463626563336630633331663764346138323466303433
64656536333531393564303864386631663635613263316137653435303962313561646334383664 38303965386635386565653035666631616239306231616530363965306134633034623936396135
63623133383531303563386562633233636436323236643764646336663038363062663032313232 32366430333763333039613734343563663065636538616139646239303533336437616162366532
65643136666664306537343433393262306534356536383038323337623835326632636464656138 38343137366563333866343537393532353835386230623536663966643730663031636639313232
39613237616365303333303737333431343361303563326266663533353639623636393961363531 33636133303432343531626539633862646466653864393737363333366238666536303663343837
33393737643062373365633431613564383962616337666631376264356431633035303665626136 39363330383432353465633132346165333564646262383736366664303239366365643533353738
30373731383361333035356138626162656238373337613334343739383064666133383432646665 65656163313966306464633237383530316338666665666236656164636433653735353739393363
65396466663762613036346137636538336130326334656634656238656664343431363365376664 30633462393933646436356365323864383239633963306366356534333036663438643438303365
63386264313665363464623335343862353432366336393032666434363131656339326632316538 37366638383066653965383764323436336230363336303233303433656563656563343630613935
63363864373462303136323133383136653732343639343964376137613337353934353061303966 64373965366662323137353631323233643463366338393639663833633635313531616539366333
30363433333631306432316462393137636361393535303938646662306263636639663637313037 30656663666561353938393761353266386533383361326439383338363762633538396638386630
63616363366139303036353633663031353366373462303234343264643136393736623735393966 31383131316137346234336462333032366337393438343237613231323164306132373136323233
32636131633065383530316336663463653134323566633262666635303831343035333433623235 38643133356166303661363761646430363734373130363334376535356565386638366630306362
37616331366263643231383264386336316264343531663736383736643235376532363736323637 63626539336134356539366166616331626361356335616665336564636638316137316230643961
62343831636636663137313032303837663331633135633632366337386161633631393438653862 65623465336232326533616538653561646263626536333738346531366661336134366362386239
64326161626131646536313830383166613163373134623532663164656265306138313766313438 39643665663566376264356332653062313536353635656231656566386333636330353765373664
61376635326165366335393730343736366536623566373866363730626434343931636531343166 34616338623161333232653832386436343361636461653338363932633337623537303261396334
34383830396530393631326135386262323037303162343665663339616266343565363433363630 30386663613335303438376234333138363432633234646133646466323930656330623161373530
31656238383533366333376463303538646538333735306435326565303833353333636439626438 36383261373139663932623933626164313765613930323035326334373231303033616665346337
62343232303863663733623231633439613333313336303733373032613862363736336137663935 32353235663465336433666539333032376365373266363436353063366139616232373037383664
37373230356234636438303966323934633530396335653463333137366533333930343236666336 31323062383063373932623030356461353039326363336165326138353335326436363165393639
35333030623835376635353936343437653563383031663133663264366530303830376336373731 33643830353734616164653833613830333066626161636130323861643866386234383136313336
37326334616538623931346462623130333165643232386566356366313431393736633765396334 37333337363462313831633437636633383137303736303264393236333633383933303939383533
39376564323431303630363836613963323532386234656431363165393439373532613139373734 38626138396537663463633961303766663636353737336365393638383832303735323266646337
61363434633363356165616664316336373335383030393732306432633765326161313934343038 62643665353431326465386162633737613935353261633963616531306233613966643862316166
33323065356539633761643032383132656466646235623131663830346535613130313964373033 38316164383433333263363630386462313639336464653061373239633235346633613237646563
34343134666463633135313036323237386235616636613237376630303536376166303137653534 62383836393063613365653635663136356538623962623961326434646635633464313932626333
38316238366665653166613937623465376332386238643066643161363666303338386366323164 36383666653264366236396638626265356338653630303930383861386534393732633437363663
64663531383162373865623063396562336639393837623062356631303266643533346232613234 38623739313131643038396335326437323231636661346164353433303235356432306532353066
62623430346165373139343562373463623166623138396435616234623961656663633163626466 63373662313366376363653039316361366266616466663663313732303962336339616235366432
31663061666630653664356463336363383462343766616162313866623734376337346533623762 32643832366231396132333236313962313932343230333832616664356333646533323732656466
32643330393161633262333230363366613837386138636536316665656435383336373835393039 34393862393434383362303531653638303366323530656661623236336630383064663135373862
62363436663435633462633761396439306264666638636230383038396635393037353134306566 61313761643038333035376535633964303564616532646139393964353165353763626235303662
39373661633030323332333733343366343333303263323861383365663132356334373465336539 65633465626365393033376437633134333532656262366462323365653466616462316664323837
65316530626663333665663338346430333032333933353839333165356465373361343765613833 64346533366238656637366665303339666433623261623635383631303862616438353166353866
31303265303538396662613164393038366261383739623963613562363234363035643166343164 66346366316562316230306233323937313364656537393063306537353237353737626164663365
63346336323737643732643863633138373831393735313036316632646138363032616462626337 38636331363138326336646434653238636463633138343134373937373835373232356363663366
35386631303266313932346466383533356634643733376536636535623063653632356362376566 37386633353439656162613736303932633333313131653364616364343761363335343430396432
64313963643461326533363164373634663663303233666136336535366539633135323335386539 39636630343066616633376237643062616666666135363232376632666132396333363334623036
31323265633234323563396666323065623236623837616362353261663235623836663566616232 63323531626632383062353162346536663233656132383734643761396264623165663738616564
31326666653533383838346565386131373238333630613634386662343630323136333438333866 61316234386135656538363861363531373232303163643364366136616130643737346438353334
39343030326632373334636430353538396237653366663434396531303031326331626633316436 63653234376562663937663135363763656236346663363738313836383466656162643131636138
31626165316333343266343764666138663034316139366332663165393264663136363866363239 63383430653030383232333830656333373765333639303265643938323833613262643863643835
35393032666638333130356666613862643761313065666430663332306561663734373061363438 66326466313730323666643939623539326639663838663737326665326164366262323731623037
31623433383162333066303362653966383638616364623262623062623539303336646333326363 33383631616530383238626431333033366134383839613761656264366331663539363131396361
62616433643731643462663362663030306264616365653531633138316361363865306237333636 64316333373134636163666634656561306130616337383030653063626161303930653730623130
32323732613364393232343833343731323037623331333739613538646361363064383736646336 33653730656332616135663631653336386166363866303932643163353963396466646662626439
35646331323265313166653232393731646562333962333339336630316538333834383366663466 39653562613461353633313533356336393334643066626137306164643530343331666430636330
61663033636636626166623861393433366261336139656136316366343264363735666132633632 63613763336663613639343036363332626232346530366633646536396338613164666163663235
34363539336662656661326139346561303061366262616130626232313030313664623130306238 37333334313436326233653866316438626366633632653336393633333931353961353132376639
31663062653734303136336634313736346437326266346537633533316238356464643534623766 66343362646630376537356638396263623262363138323630363834386162656236313365393766
61383934636636366565393330363666363131646330343434393938663231333435323062636464 39616135303337303166313663383635636165373333313463623731346561356430326164663164
38363265663566313535353565623733323363666132636139383638306635363661306463653537 30333839386564616133393630396538633032616332646639616161643739626437306532356136
36343734356562323164396136383261623464646534643738333864653035336266383131353866 34383432626136336261666166633739313663333664663035333533626334623132373037663239
37363436393039653431336562363263363536336639396632323937323431366139313235663839 38393638323833643730353432656365396161353161613733653562303731616462623436643832
63663263326232333162326633623863623333653932643339626263326337646264656134383733 35376133653665333432303132383966333362313262393931373264616664643438346566333764
38613065393931393862633732306139646663346136393765343432313131636165336630616537 34303439633538376439646435646631336361316436306330653838363665366461333366656239
37646461313764666138386538303937623034336163376130623365383566653463313930653333 33303038643139643431613764333864306134666166376164623038333330613933333766643830
64316134663438636664313339393734383464663631346465666363363961313562376336373965 30653637666533363234626465353734303538623233623532393936303566306434346537343932
65373430343962303339626164656234346234363033636339656362333136626631356233363365 39393863373635626530326139376339653764623265636530323330376633363265636439353738
31313131643030633364306162303238303163663934366262636639353636326339616530316563 32353634316162656461353666666338633233393039343935613539623766363237656161383364
36626530336335333338343535633137663961363363613933336230306533353434643534306166 61356165313637343134363932333136643464353436323333653939613666653164303363656637
37663334626263316538366637376562316537386632366637623235343838626639306131313138 32386561326461353665633339373038616464633430303763666234313032653735373832393539
38393636313037393535 33333334663336346139373064633364353530366166636465343734633465623065666563383539
30316166356239316530633239313765623438306234666235616464313765356165363435303336
39633532393965646539356439396132616637383430653762616562323065343233383034363130
32623331343035306165313637356131633963353035313838363439343133636631626532613366
33323364616262303962

2
roles/caddy/defaults/main.yml
View File

@ -2,7 +2,7 @@
# file: roles/caddy/defaults/main.yml # file: roles/caddy/defaults/main.yml
# parent directory of vhost document roots # parent directory of vhost document roots
caddy_root_prefix: /var/www caddy_root_prefix: "{{ web_root_prefix }}"
# Email address to use for the ACME account managing the site's certificates. # Email address to use for the ACME account managing the site's certificates.
# Not sure what Caddy does if this doesn't exist. # Not sure what Caddy does if this doesn't exist.

13
roles/caddy/tasks/main.yml
View File

@ -18,7 +18,7 @@
dest: /etc/apt/keyrings/caddy-stable-archive-keyring.key dest: /etc/apt/keyrings/caddy-stable-archive-keyring.key
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
register: download_caddy_signing_key register: download_caddy_signing_key
when: not caddy_signing_key_stat.stat.exists when: not caddy_signing_key_stat.stat.exists
tags: tags:
@ -27,7 +27,7 @@
- name: Add Caddy stable repo - name: Add Caddy stable repo
ansible.builtin.apt_repository: ansible.builtin.apt_repository:
repo: 'deb [signed-by=/etc/apt/keyrings/caddy-stable-archive-keyring.key] https://dl.cloudsmith.io/public/caddy/stable/deb/debian any-version main' repo: deb [signed-by=/etc/apt/keyrings/caddy-stable-archive-keyring.key] https://dl.cloudsmith.io/public/caddy/stable/deb/debian any-version main
filename: caddy-stable filename: caddy-stable
state: present state: present
register: add_caddy_apt_repository register: add_caddy_apt_repository
@ -38,9 +38,7 @@
- name: Update apt cache - name: Update apt cache
ansible.builtin.apt: # noqa no-handler ansible.builtin.apt: # noqa no-handler
update_cache: true update_cache: true
when: when: (download_caddy_signing_key.status_code is defined and download_caddy_signing_key.status_code == 200) or add_caddy_apt_repository is changed
(download_caddy_signing_key.status_code is defined and download_caddy_signing_key.status_code == 200) or
add_caddy_apt_repository is changed
tags: tags:
- packages - packages
- caddy - caddy
@ -59,7 +57,7 @@
ansible.builtin.template: ansible.builtin.template:
src: etc/caddy/Caddyfile.j2 src: etc/caddy/Caddyfile.j2
dest: /etc/caddy/Caddyfile dest: /etc/caddy/Caddyfile
mode: 0755 mode: "0755"
owner: root owner: root
group: root group: root
notify: notify:
@ -70,9 +68,10 @@
ansible.builtin.file: ansible.builtin.file:
path: /etc/caddy/conf.d path: /etc/caddy/conf.d
state: directory state: directory
mode: 0755 mode: "0755"
owner: root owner: root
group: root group: root
tags: caddy
# TODO: the variable is still named nginx_vhosts # TODO: the variable is still named nginx_vhosts
- name: Configure Caddy virtual hosts - name: Configure Caddy virtual hosts

3
roles/caddy/tasks/vhosts.yml
View File

@ -1,10 +1,9 @@
--- ---
- name: Configure vhosts - name: Configure vhosts
ansible.builtin.template: ansible.builtin.template:
src: etc/caddy/conf.d/vhost.j2 src: etc/caddy/conf.d/vhost.j2
dest: /etc/caddy/conf.d/{{ item.domain_name }} dest: /etc/caddy/conf.d/{{ item.domain_name }}
mode: 0644 mode: "0644"
owner: root owner: root
group: root group: root
loop: "{{ nginx_vhosts }}" loop: "{{ nginx_vhosts }}"

23
roles/caddy/templates/etc/caddy/conf.d/vhost.j2
View File

@ -8,6 +8,12 @@
{% set needs_php = item.needs_php | default(false) %} {% set needs_php = item.needs_php | default(false) %}
{% set has_gitea = item.has_gitea | default(false) %} {% set has_gitea = item.has_gitea | default(false) %}
{% set static_site = item.static_site | default(false) %} {% set static_site = item.static_site | default(false) %}
{# Allow sites to override the document root #}
{% if item.document_root is defined %}
{% set document_root = item.document_root %}
{% else %}
{% set document_root = (caddy_root_prefix, domain_name) | ansible.builtin.path_join %}
{% endif %}
{% if domain_aliases %} {% if domain_aliases %}
{# domain_aliases is a string, so we split on space #} {# domain_aliases is a string, so we split on space #}
@ -21,15 +27,20 @@
{{ domain_name }} { {{ domain_name }} {
{% if has_gitea %} {% if has_gitea %}
reverse_proxy :3000 reverse_proxy :3000
{% endif %} {% elif static_site -%}
root * {{ document_root }}
{% if static_site -%} encode
root * {{ item.document_root }}
encode zstd gzip
file_server file_server
{% endif %} {% elif has_wordpress -%}
root * {{ document_root }}
encode
{% if ansible_distribution == 'Debian' and ansible_distribution_major_version is version('12', '==') -%}
php_fastcgi unix//run/php/php8.2-fpm-{{ domain_name }}.sock
{% endif -%}
file_server
{% endif -%}
import security-headers import security-headers
} }

10004
roles/common/files/abuseipdb-ipv4.nft
View File

File diff suppressed because it is too large Load Diff

5
roles/common/files/abuseipdb-ipv6.nft
View File

@ -1,5 +0,0 @@
#!/usr/sbin/nft -f
define ABUSEIPDB_IPV6 = {
fd21:3523:74e0:7301::
}

89
roles/common/files/aggregate-cidr-addresses.pl
View File

@ -1,89 +0,0 @@
#!/usr/bin/perl
#
# aggregate-cidr-addresses - combine a list of CIDR address blocks
# Copyright (C) 2001,2007 Mark Suter <suter@zwitterion.org>
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see L<http://www.gnu.org/licenses/>.
#
# [MJS 22 Oct 2001] Aggregate CIDR addresses
# [MJS 9 Oct 2007] Overlap idea from Anthony Ledesma at theplanet dot com.
# [MJS 16 Feb 2012] Prompted to clarify license by Alexander Talos-Zens - at at univie dot ac dot at
# [MJS 21 Feb 2012] IPv6 fixes by Alexander Talos-Zens
# [MJS 21 Feb 2012] Split ranges into prefixes (fixes a 10+ year old bug)
use strict;
use warnings;
use English qw( -no_match_vars );
use Net::IP;
## Read in all the IP addresses
my @addrs = map { Net::IP->new($_) or die "$PROGRAM_NAME: Not an IP: \"$_\"."; }
map { / \A \s* (.+?) \s* \Z /msix and $1; } <>;
## Split any ranges into prefixes
@addrs = map {
defined $_->prefixlen ? $_ : map { Net::IP->new($_) }
$_->find_prefixes
} @addrs;
## Sort the IP addresses
@addrs = sort { $a->version <=> $b->version or $a->bincomp( 'lt', $b ) ? -1 : $a->bincomp( 'gt', $b ) ? 1 : 0 } @addrs;
## Handle overlaps
my $count = 0;
my $current = $addrs[0];
foreach my $next ( @addrs[ 1 .. $#addrs ] ) {
my $r = $current->overlaps($next);
if ( $current->version != $next->version or $r == $IP_NO_OVERLAP ) {
$current = $next;
$count++;
}
elsif ( $r == $IP_A_IN_B_OVERLAP ) {
$current = $next;
splice @addrs, $count, 1;
}
elsif ( $r == $IP_B_IN_A_OVERLAP or $r == $IP_IDENTICAL ) {
splice @addrs, $count + 1, 1;
}
else {
die "$PROGRAM_NAME: internal error - overlaps() returned an unexpected value!\n";
}
}
## Keep aggregating until we don't change anything
my $change = 1;
while ($change) {
$change = 0;
my @new_addrs = ();
$current = $addrs[0];
foreach my $next ( @addrs[ 1 .. $#addrs ] ) {
if ( my $total = $current->aggregate($next) ) {
$current = $total;
$change = 1;
}
else {
push @new_addrs, $current;
$current = $next;
}
}
push @new_addrs, $current;
@addrs = @new_addrs;
}
## Print out the IP addresses
foreach (@addrs) {
print $_->prefix(), "\n";
}
# $Id: aggregate-cidr-addresses,v 1.9 2012/02/21 10:14:22 suter Exp suter $

2
roles/common/files/etc/cron-apt/3-download
View File

@ -1,2 +0,0 @@
autoclean -y
upgrade -y -o APT::Get::Show-Upgraded=true

5
roles/common/files/etc/cron-apt/config
View File

@ -1,5 +0,0 @@
# Configuration for cron-apt. For further information about the possible
# configuration settings see the README file.
MAILON="never"
OPTIONS="-o quiet=1 -o Dir::Etc::SourceList=/etc/apt/security.sources.list -o Dir::Etc::SourceParts=\"/dev/null\""

2
roles/common/files/spamhaus-ipv4.nft → roles/common/files/firehol_level1-ipv4.nft
View File

@ -1,5 +1,5 @@
#!/usr/sbin/nft -f #!/usr/sbin/nft -f
define SPAMHAUS_IPV4 = { define FIREHOL_LEVEL1_IPV4 = {
192.168.254.254/32 192.168.254.254/32
} }

5
roles/common/files/spamhaus-ipv6.nft
View File

@ -1,5 +0,0 @@
#!/usr/sbin/nft -f
define SPAMHAUS_IPV6 = {
fd21:3523:74e0:7301::/64
}

27
roles/common/files/update-abusech-nftables.service
View File

@ -1,27 +0,0 @@
[Unit]
Description=Update Abuse.ch SSL Blacklist IPs
# This service will fail if nftables is not running so we use Requires to make
# sure that nftables is started.
Requires=nftables.service
# Make sure the network is up and nftables is started
After=network-online.target nftables.service
Wants=network-online.target update-abusech-nftables.timer
[Service]
# https://www.ctrl.blog/entry/systemd-service-hardening.html
# Doesn't need access to /home or /root
ProtectHome=true
# Possibly only works on Ubuntu 18.04+
ProtectKernelTunables=true
ProtectSystem=full
# Newer systemd can use ReadWritePaths to list files, but this works everywhere
ReadWriteDirectories=/etc/nftables
PrivateTmp=true
WorkingDirectory=/var/tmp
SyslogIdentifier=update-abusech-nftables
ExecStart=/usr/bin/flock -x update-abusech-nftables.lck \
/usr/local/bin/update-abusech-nftables.sh
[Install]
WantedBy=multi-user.target

63
roles/common/files/update-abusech-nftables.sh
View File

@ -1,63 +0,0 @@
#!/usr/bin/env bash
#
# update-abuseipdb-nftables.sh v0.0.1
#
# Download IP addresses seen using a blacklisted SSL certificate and load them
# into nftables sets. As of 2021-07-28 these appear to only be IPv4.
#
# See: https://sslbl.abuse.ch/blacklist
#
# Copyright (C) 2021 Alan Orth
#
# SPDX-License-Identifier: GPL-3.0-only
# Exit on first error
set -o errexit
abusech_ipv4_set_path=/etc/nftables/abusech-ipv4.nft
abusech_list_temp=$(mktemp)
echo "Downloading Abuse.sh SSL Blacklist IPs"
abusech_response=$(curl -s -G -w "%{http_code}\n" https://sslbl.abuse.ch/blacklist/sslipblacklist.txt --output "$abusech_list_temp")
if [[ $abusech_response -ne 200 ]]; then
echo "Abuse.ch responded: HTTP $abusech_response"
exit 1
fi
if [[ -f "$abusech_list_temp" ]]; then
echo "Processing IPv4 list"
abusech_ipv4_list_temp=$(mktemp)
abusech_ipv4_set_temp=$(mktemp)
# Remove comments, DOS carriage returns, and IPv6 addresses (even though
# Abuse.ch seems to only have IPv4 addresses, let's not break our shit on
# that assumption some time down the line).
sed -e '/#/d' -e 's/
//' -e '/:/d' "$abusech_list_temp" > "$abusech_ipv4_list_temp"
echo "Building abusech-ipv4 set"
cat << NFT_HEAD > "$abusech_ipv4_set_temp"
#!/usr/sbin/nft -f
define ABUSECH_IPV4 = {
NFT_HEAD
while read -r network; do
# nftables doesn't mind if the last element in the set has a trailing
# comma so we don't need to do anything special here.
echo "$network," >> "$abusech_ipv4_set_temp"
done < $abusech_ipv4_list_temp
echo "}" >> "$abusech_ipv4_set_temp"
install -m 0600 "$abusech_ipv4_set_temp" "$abusech_ipv4_set_path"
rm -f "$abusech_list_temp" "$abusech_ipv4_list_temp" "$abusech_ipv4_set_temp"
fi
echo "Reloading nftables"
# The abusech nftables sets are included by nftables.conf

12
roles/common/files/update-abusech-nftables.timer
View File

@ -1,12 +0,0 @@
[Unit]
Description=Update Abuse.ch SSL Blacklist IPs
[Timer]
# Once a day at midnight
OnCalendar=*-*-* 00:00:00
# Add a random delay of 0–3600 seconds
RandomizedDelaySec=3600
Persistent=true
[Install]
WantedBy=timers.target

10
roles/common/files/update-spamhaus-nftables.service → roles/common/files/update-firehol-nftables.service
View File

@ -1,11 +1,11 @@
[Unit] [Unit]
Description=Update Spamhaus lists Description=Update FireHOL lists
# This service will fail if nftables is not running so we use Requires to make # This service will fail if nftables is not running so we use Requires to make
# sure that nftables is started. # sure that nftables is started.
Requires=nftables.service Requires=nftables.service
# Make sure the network is up and nftables is started # Make sure the network is up and nftables is started
After=network-online.target nftables.service After=network-online.target nftables.service
Wants=network-online.target update-spamhaus-nftables.timer Wants=network-online.target update-firehol-nftables.timer
[Service] [Service]
# https://www.ctrl.blog/entry/systemd-service-hardening.html # https://www.ctrl.blog/entry/systemd-service-hardening.html
@ -19,9 +19,9 @@ ReadWriteDirectories=/etc/nftables
PrivateTmp=true PrivateTmp=true
WorkingDirectory=/var/tmp WorkingDirectory=/var/tmp
SyslogIdentifier=update-spamhaus-nftables SyslogIdentifier=update-firehol-nftables
ExecStart=/usr/bin/flock -x update-spamhaus-nftables.lck \ ExecStart=/usr/bin/flock -x update-firehol-nftables.lck \
/usr/local/bin/update-spamhaus-nftables.sh /usr/local/bin/update-firehol-nftables.sh
[Install] [Install]
WantedBy=multi-user.target WantedBy=multi-user.target

2
roles/common/files/update-spamhaus-nftables.timer → roles/common/files/update-firehol-nftables.timer
View File

@ -1,5 +1,5 @@
[Unit] [Unit]
Description=Update Spamhaus lists Description=Update FireHOL lists
[Timer] [Timer]
# Once a day at midnight # Once a day at midnight

91
roles/common/files/update-spamhaus-nftables.sh
View File

@ -1,91 +0,0 @@
#!/usr/bin/env bash
#
# update-spamhaus-nftables.sh v0.0.1
#
# Download Spamhaus DROP lists and load them into nftables sets.
#
# See: https://www.spamhaus.org/drop/
#
# Copyright (C) 2021 Alan Orth
#
# SPDX-License-Identifier: GPL-3.0-only
# Exit on first error
set -o errexit
spamhaus_ipv4_set_path=/etc/nftables/spamhaus-ipv4.nft
spamhaus_ipv6_set_path=/etc/nftables/spamhaus-ipv6.nft
function download() {
echo "Downloading $1"
wget -q -O - "https://www.spamhaus.org/drop/$1" > "$1"
}
download drop.txt
download edrop.txt
download dropv6.txt
if [[ -f "drop.txt" && -f "edrop.txt" ]]; then
echo "Processing IPv4 DROP lists"
spamhaus_ipv4_list_temp=$(mktemp)
spamhaus_ipv4_set_temp=$(mktemp)
# Extract all networks from drop.txt and edrop.txt, skipping blank lines and
# comments. Use aggregate-cidr-addresses.pl to merge overlapping IPv4 CIDR
# ranges to work around a firewalld bug.
#
# See: https://bugzilla.redhat.com/show_bug.cgi?id=1836571
cat drop.txt edrop.txt | sed -e '/^$/d' -e '/^;.*/d' -e 's/[[:space:]];[[:space:]].*//' | aggregate-cidr-addresses.pl > "$spamhaus_ipv4_list_temp"
echo "Building spamhaus-ipv4 set"
cat << NFT_HEAD > "$spamhaus_ipv4_set_temp"
#!/usr/sbin/nft -f
define SPAMHAUS_IPV4 = {
NFT_HEAD
while read -r network; do
# nftables doesn't mind if the last element in the set has a trailing
# comma so we don't need to do anything special here.
echo "$network," >> "$spamhaus_ipv4_set_temp"
done < $spamhaus_ipv4_list_temp
echo "}" >> "$spamhaus_ipv4_set_temp"
install -m 0600 "$spamhaus_ipv4_set_temp" "$spamhaus_ipv4_set_path"
rm -f "$spamhaus_ipv4_list_temp" "$spamhaus_ipv4_set_temp"
fi
if [[ -f "dropv6.txt" ]]; then
echo "Processing IPv6 DROP lists"
spamhaus_ipv6_list_temp=$(mktemp)
spamhaus_ipv6_set_temp=$(mktemp)
sed -e '/^$/d' -e '/^;.*/d' -e 's/[[:space:]];[[:space:]].*//' dropv6.txt > "$spamhaus_ipv6_list_temp"
echo "Building spamhaus-ipv6 set"
cat << NFT_HEAD > "$spamhaus_ipv6_set_temp"
#!/usr/sbin/nft -f
define SPAMHAUS_IPV6 = {
NFT_HEAD
while read -r network; do
echo "$network," >> "$spamhaus_ipv6_set_temp"
done < $spamhaus_ipv6_list_temp
echo "}" >> "$spamhaus_ipv6_set_temp"
install -m 0600 "$spamhaus_ipv6_set_temp" "$spamhaus_ipv6_set_path"
rm -f "$spamhaus_ipv6_list_temp" "$spamhaus_ipv6_set_temp"
fi
echo "Reloading nftables"
# The spamhaus nftables sets are included by nftables.conf
/usr/sbin/nft -f /etc/nftables.conf
rm -v drop.txt edrop.txt dropv6.txt

15
roles/common/handlers/main.yml
View File

@ -2,19 +2,26 @@
# ansible.builtin.file: roles/common/handlers/main.yml # ansible.builtin.file: roles/common/handlers/main.yml
- name: reload sshd - name: reload sshd
ansible.builtin.systemd: name={{ sshd_service_name }} state=reloaded ansible.builtin.systemd:
name: "{{ sshd_service_name }}"
state: reloaded
- name: reload sysctl - name: reload sysctl
command: sysctl -p /etc/sysctl.conf command: sysctl -p /etc/sysctl.conf
- name: reload systemd - name: reload systemd
ansible.builtin.systemd: daemon_reload=true ansible.builtin.systemd:
daemon_reload: true
- name: restart nftables - name: restart nftables
ansible.builtin.systemd: name=nftables state=restarted ansible.builtin.systemd:
name: nftables
state: restarted
# 2021-09-28: note to self to keep fail2ban at the end, as handlers are executed # 2021-09-28: note to self to keep fail2ban at the end, as handlers are executed
# in the order they are defined, not in the order they are listed in the task's # in the order they are defined, not in the order they are listed in the task's
# notify statement and we must restart fail2ban after updating the firewall. # notify statement and we must restart fail2ban after updating the firewall.
- name: restart fail2ban - name: restart fail2ban
ansible.builtin.systemd: name=fail2ban state=restarted ansible.builtin.systemd:
name: fail2ban
state: restarted

19
roles/common/tasks/cron-apt.yml
View File

@ -1,12 +1,17 @@
--- ---
- name: Remove cron-apt
ansible.builtin.apt:
name: cron-apt
state: absent
cache_valid_time: 3600
- name: Configure cron-apt (config) - name: Remove cron-apt configs
ansible.builtin.copy: src={{ item.src }} dest={{ item.dest }} mode={{ item.mode }} owner={{ item.owner }} group={{ item.group }} ansible.builtin.file:
path: "{{ item }}"
state: absent
loop: loop:
- { src: 'etc/cron-apt/config', dest: '/etc/cron-apt/config', mode: '0644', owner: 'root', group: 'root' } - /etc/cron-apt/config
- { src: 'etc/cron-apt/3-download', dest: '/etc/cron-apt/action.d/3-download', mode: '0644', owner: 'root', group: 'root' } - /etc/cron-apt/action.d/3-download
- /etc/apt/security.sources.list
- name: Configure cron-apt (security)
ansible.builtin.template: src=security.sources.list.j2 dest=/etc/apt/security.sources.list mode=0644 owner=root group=root
# vim: set ts=2 sw=2: # vim: set ts=2 sw=2:

19
roles/common/tasks/fail2ban.yml
View File

@ -1,21 +1,32 @@
--- ---
- name: Install fail2ban
when:
- ansible_distribution_major_version is version('11', '>=')
ansible.builtin.package:
name:
- fail2ban
- python3-systemd
state: present
cache_valid_time: 3600
- name: Configure fail2ban sshd filter - name: Configure fail2ban sshd filter
ansible.builtin.template: ansible.builtin.template:
src: etc/fail2ban/jail.d/sshd.local.j2 src: etc/fail2ban/jail.d/sshd.local.j2
dest: /etc/fail2ban/jail.d/sshd.local dest: /etc/fail2ban/jail.d/sshd.local
owner: root owner: root
mode: 0644 mode: "0644"
notify: restart fail2ban notify: restart fail2ban
- name: Configure fail2ban nginx filter - name: Configure fail2ban nginx filter
when: when:
- webserver is defined and webserver == 'nginx'
- extra_fail2ban_filters is defined - extra_fail2ban_filters is defined
- "'nginx' in extra_fail2ban_filters" - "'nginx' in extra_fail2ban_filters"
ansible.builtin.template: ansible.builtin.template:
src: etc/fail2ban/jail.d/nginx.local.j2 src: etc/fail2ban/jail.d/nginx.local.j2
dest: /etc/fail2ban/jail.d/nginx.local dest: /etc/fail2ban/jail.d/nginx.local
owner: root owner: root
mode: 0644 mode: "0644"
notify: restart fail2ban notify: restart fail2ban
- name: Create fail2ban service override directory - name: Create fail2ban service override directory
@ -23,7 +34,7 @@
path: /etc/systemd/system/fail2ban.service.d path: /etc/systemd/system/fail2ban.service.d
state: directory state: directory
owner: root owner: root
mode: 0755 mode: "0755"
# See Arch Linux's example: https://wiki.archlinux.org/index.php/Fail2ban # See Arch Linux's example: https://wiki.archlinux.org/index.php/Fail2ban
- name: Configure fail2ban service override - name: Configure fail2ban service override
@ -31,7 +42,7 @@
src: etc/systemd/system/fail2ban.service.d/override.conf.j2 src: etc/systemd/system/fail2ban.service.d/override.conf.j2
dest: /etc/systemd/system/fail2ban.service.d/override.conf dest: /etc/systemd/system/fail2ban.service.d/override.conf
owner: root owner: root
mode: 0644 mode: "0644"
notify: notify:
- reload systemd - reload systemd
- restart fail2ban - restart fail2ban

20
roles/common/tasks/firewall.yml Normal file
View File

@ -0,0 +1,20 @@
---
- name: Configure firewall (Debian)
when: ansible_distribution == 'Debian'
ansible.builtin.include_tasks:
file: firewall_Debian.yml
apply:
tags:
- firewall
tags: firewall
- name: Configure firewall (Ubuntu)
when: ansible_distribution == 'Ubuntu'
ansible.builtin.include_tasks:
file: firewall_Ubuntu.yml
apply:
tags:
- firewall
tags: firewall

128
roles/common/tasks/firewall_Debian.yml
View File

@ -1,116 +1,28 @@
--- ---
# Debian 11+ will use nftables directly, with no firewalld. # Debian 11+ will use nftables directly, with no firewalld.
- block: - name: Install Debian firewall packages
- name: Install Debian firewall packages when: ansible_distribution_major_version is version('11', '>=')
when: ansible_distribution_major_version is version('11', '>=') ansible.builtin.package:
ansible.builtin.package: name:
name: - libnet-ip-perl # for aggregate-cidr-addresses.pl
- fail2ban - nftables
- libnet-ip-perl # for aggregate-cidr-addresses.pl - curl # for nftables update scripts
- nftables state: present
- python3-systemd cache_valid_time: 3600
- curl # for nftables update scripts
state: present
cache_valid_time: 3600
- name: Remove iptables on newer Debian - name: Remove iptables on newer Debian
when: ansible_distribution_major_version is version('11', '>=') when: ansible_distribution_major_version is version('11', '>=')
ansible.builtin.apt: ansible.builtin.apt:
pkg: iptables pkg: iptables
state: absent state: absent
- name: Copy nftables.conf - name: Configure nftables
when: ansible_distribution_major_version is version('11', '>=') ansible.builtin.include_tasks: nftables.yml
ansible.builtin.template: when: ansible_distribution_version is version('11', '>=')
src: nftables.conf.j2
dest: /etc/nftables.conf
owner: root
mode: 0644
notify:
- restart nftables
- restart fail2ban
- name: Create /etc/nftables extra config directory - ansible.builtin.include_tasks: fail2ban.yml
when: ansible_distribution_major_version is version('11', '>=') when:
ansible.builtin.file: - ansible_distribution_major_version is version('9', '>=')
path: /etc/nftables
state: directory
owner: root
mode: 0755
- name: Copy extra nftables configuration files
when: ansible_distribution_major_version is version('11', '>=')
ansible.builtin.copy:
src: "{{ item.src }}"
dest: "/etc/nftables/{{ item.src }}"
owner: root
group: root
mode: 0644
force: "{{ item.force }}"
loop:
- { src: "spamhaus-ipv4.nft", force: "no" }
- { src: "spamhaus-ipv6.nft", force: "no" }
- { src: "abusech-ipv4.nft", force: "no" }
- { src: "abuseipdb-ipv4.nft", force: "yes" }
- { src: "abuseipdb-ipv6.nft", force: "yes" }
notify:
- restart nftables
- restart fail2ban
- name: Copy nftables update scripts
when: ansible_distribution_version is version('11', '>=')
ansible.builtin.copy:
src: "{{ item }}"
dest: "/usr/local/bin/{{ item }}"
mode: 0755
owner: root
group: root
loop:
- update-spamhaus-nftables.sh
- aggregate-cidr-addresses.pl
- update-abusech-nftables.sh
- name: Copy nftables systemd units
when: ansible_distribution_version is version('11', '>=')
ansible.builtin.copy:
src: "{{ item }}"
dest: "/etc/systemd/system/{{ item }}"
mode: 0644
owner: root
group: root
loop:
- update-spamhaus-nftables.service
- update-spamhaus-nftables.timer
- update-abusech-nftables.service
- update-abusech-nftables.timer
register: nftables_systemd_units
# need to reload to pick up service/timer/environment changes
- name: Reload systemd daemon
ansible.builtin.systemd:
daemon_reload: true
when: nftables_systemd_units is changed
- name: Start and enable nftables update timers
when: ansible_distribution_version is version('11', '>=')
ansible.builtin.systemd:
name: "{{ item }}"
state: started
enabled: true
loop:
- update-spamhaus-nftables.timer
- update-abusech-nftables.timer
- name: Start and enable nftables
when: ansible_distribution_major_version is version('11', '>=')
ansible.builtin.systemd:
name: nftables
state: started
enabled: true
- ansible.builtin.include_tasks: fail2ban.yml
when: ansible_distribution_major_version is version('9', '>=')
tags: firewall
# vim: set sw=2 ts=2: # vim: set sw=2 ts=2:

125
roles/common/tasks/firewall_Ubuntu.yml
View File

@ -1,114 +1,27 @@
--- ---
# Ubuntu 20.04 will use nftables directly, with no firewalld. # Ubuntu 20.04 will use nftables directly, with no firewalld.
- block: - name: Install Ubuntu firewall packages
- name: Install Ubuntu firewall packages when: ansible_distribution_version is version('20.04', '>=')
ansible.builtin.package: ansible.builtin.package:
name: name:
- fail2ban - libnet-ip-perl # for aggregate-cidr-addresses.pl
- libnet-ip-perl # for aggregate-cidr-addresses.pl - nftables
- nftables - curl # for nftables update scripts
- python3-systemd state: present
- curl # for nftables update scripts cache_valid_time: 3600
state: present
cache_valid_time: 3600
- name: Remove ufw - name: Remove ufw
ansible.builtin.package: ansible.builtin.package:
name: ufw name: ufw
state: absent state: absent
- name: Copy nftables.conf - name: Configure nftables
when: ansible_distribution_version is version('20.04', '>=') ansible.builtin.include_tasks: nftables.yml
ansible.builtin.template: when: ansible_distribution_version is version('20.04', '>=')
src: nftables.conf.j2
dest: /etc/nftables.conf
owner: root
mode: 0644
notify:
- restart nftables
- restart fail2ban
- name: Create /etc/nftables extra config directory - ansible.builtin.include_tasks: fail2ban.yml
when: ansible_distribution_version is version('20.04', '>=') when:
ansible.builtin.file: - ansible_distribution_version is version('16.04', '>=')
path: /etc/nftables
state: directory
owner: root
mode: 0755
- name: Copy extra nftables configuration files
when: ansible_distribution_version is version('20.04', '>=')
ansible.builtin.copy:
src: "{{ item.src }}"
dest: "/etc/nftables/{{ item.src }}"
owner: root
group: root
mode: 0644
force: "{{ item.force }}"
loop:
- { src: "spamhaus-ipv4.nft", force: "no" }
- { src: "spamhaus-ipv6.nft", force: "no" }
- { src: "abusech-ipv4.nft", force: "no" }
- { src: "abuseipdb-ipv4.nft", force: "yes" }
- { src: "abuseipdb-ipv6.nft", force: "yes" }
notify:
- restart nftables
- restart fail2ban
- name: Copy nftables update scripts
when: ansible_distribution_version is version('20.04', '>=')
ansible.builtin.copy:
src: "{{ item }}"
dest: "/usr/local/bin/{{ item }}"
mode: 0755
owner: root
group: root
loop:
- update-spamhaus-nftables.sh
- aggregate-cidr-addresses.pl
- update-abusech-nftables.sh
- name: Copy nftables systemd units
when: ansible_distribution_version is version('20.04', '>=')
ansible.builtin.copy:
src: "{{ item }}"
dest: "/etc/systemd/system/{{ item }}"
mode: 0644
owner: root
group: root
loop:
- update-spamhaus-nftables.service
- update-spamhaus-nftables.timer
- update-abusech-nftables.service
- update-abusech-nftables.timer
register: nftables_systemd_units
# need to reload to pick up service/timer/environment changes
- name: Reload systemd daemon
ansible.builtin.systemd:
daemon_reload: true
when: nftables_systemd_units is changed
- name: Start and enable nftables update timers
when: ansible_distribution_version is version('20.04', '>=')
ansible.builtin.systemd:
name: "{{ item }}"
state: started
enabled: true
loop:
- update-spamhaus-nftables.timer
- update-abusech-nftables.timer
- name: Start and enable nftables
when: ansible_distribution_version is version('20.04', '>=')
ansible.builtin.systemd:
name: nftables
state: started
enabled: true
- ansible.builtin.include_tasks: fail2ban.yml
when: ansible_distribution_version is version('16.04', '>=')
tags: firewall
# vim: set sw=2 ts=2: # vim: set sw=2 ts=2:

10
roles/common/tasks/main.yml
View File

@ -1,6 +1,6 @@
--- ---
- name: Import OS-specific variables - name: Import OS-specific variables
ansible.builtin.include_vars: "vars/{{ ansible_distribution }}.yml" ansible.builtin.include_vars: vars/{{ ansible_distribution }}.yml
tags: always tags: always
- name: Configure network time - name: Configure network time
@ -18,13 +18,7 @@
tags: packages tags: packages
- name: Configure firewall - name: Configure firewall
ansible.builtin.include_tasks: firewall_Debian.yml ansible.builtin.import_tasks: firewall.yml
when: ansible_distribution == 'Debian'
tags: firewall
- name: Configure firewall
ansible.builtin.include_tasks: firewall_Ubuntu.yml
when: ansible_distribution == 'Ubuntu'
tags: firewall tags: firewall
- name: Configure secure shell daemon - name: Configure secure shell daemon

97
roles/common/tasks/nftables.yml Normal file
View File

@ -0,0 +1,97 @@
---
# Common nftables tasks for Ubuntu 20.04, Ubuntu 22.04, Ubuntu 24.04, Debian 11,
# and Debian 12.
- name: Copy nftables.conf
ansible.builtin.template:
src: nftables.conf.j2
dest: /etc/nftables.conf
owner: root
mode: "0644"
notify:
- restart nftables
- restart fail2ban
- name: Create /etc/nftables extra config directory
ansible.builtin.file:
path: /etc/nftables
state: directory
owner: root
mode: "0755"
- name: Copy extra nftables configuration files
ansible.builtin.copy:
src: "{{ item.src }}"
dest: /etc/nftables/{{ item.src }}
owner: root
group: root
mode: "0644"
force: "{{ item.force }}"
loop:
- { src: firehol_level1-ipv4.nft, force: false }
notify:
- restart nftables
- restart fail2ban
- name: Copy nftables update scripts
ansible.builtin.template:
src: update-firehol-nftables.sh.j2
dest: /usr/local/bin/update-firehol-nftables.sh
mode: "0755"
owner: root
group: root
- name: Remove deprecated data and scripts
ansible.builtin.file:
path: "{{ item }}"
state: absent
loop:
- /etc/nftables/spamhaus-ipv4.nft
- /etc/nftables/spamhaus-ipv6.nft
- /etc/nftables/abuseipdb-ipv4.nft
- /etc/nftables/abuseipdb-ipv6.nft
- /etc/nftables/abusech-ipv4.nft
- /usr/local/bin/update-abusech-nftables.sh
- /usr/local/bin/update-spamhaus-nftables.sh
- /etc/systemd/system/update-abusech-nftables.service
- /etc/systemd/system/update-abusech-nftables.timer
- /etc/systemd/system/update-spamhaus-nftables.service
- /etc/systemd/system/update-spamhaus-nftables.timer
- /usr/local/bin/aggregate-cidr-addresses.pl
notify:
- restart nftables
- restart fail2ban
- name: Copy nftables systemd units
ansible.builtin.copy:
src: "{{ item }}"
dest: /etc/systemd/system/{{ item }}
mode: "0644"
owner: root
group: root
loop:
- update-firehol-nftables.service
- update-firehol-nftables.timer
register: nftables_systemd_units
# need to reload to pick up service/timer/environment changes
- name: Reload systemd daemon
ansible.builtin.systemd: # noqa no-handler
daemon_reload: true
when: nftables_systemd_units is changed
- name: Start and enable nftables update timers
ansible.builtin.systemd:
name: "{{ item }}"
state: started
enabled: true
loop:
- update-firehol-nftables.timer
- name: Start and enable nftables
ansible.builtin.systemd:
name: nftables
state: started
enabled: true
# vim: set sw=2 ts=2:

11
roles/common/tasks/ntp.yml
View File

@ -4,16 +4,19 @@
# client. # client.
- name: Set timezone - name: Set timezone
when: timezone is defined and ansible_service_mgr == 'systemd' when:
command: /usr/bin/timedatectl set-timezone {{ timezone }} - timezone is defined
- ansible_service_mgr == 'systemd'
community.general.timezone:
name: "{{ timezone }}"
tags: timezone tags: timezone
# Apparently some cloud images don't have this installed by default. From what # Apparently some cloud images don't have this installed by default. From what
# I can see on existing servers, systemd-timesyncd is a standalone package on # I can see on existing servers, systemd-timesyncd is a standalone package on
# Ubuntu 20.04 and Debian 11. # Ubuntu 20.04 and Debian 11.
- name: Install systemd-timesyncd - name: Install systemd-timesyncd
when: (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==')) or when: (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==')) or (ansible_distribution == 'Debian' and ansible_distribution_version
(ansible_distribution == 'Debian' and ansible_distribution_version is version('11', '>=')) is version('11', '>='))
ansible.builtin.apt: name=systemd-timesyncd state=present cache_valid_time=3600 ansible.builtin.apt: name=systemd-timesyncd state=present cache_valid_time=3600
- name: Start and enable systemd's NTP client - name: Start and enable systemd's NTP client

18
roles/common/tasks/packages_Debian.yml
View File

@ -1,20 +1,6 @@
--- ---
- name: Configure Debian packages - name: Configure Debian packages
block: block:
# Create directory for third-party package signing keys. Required on distros
# older than Debian 12 / Ubuntu 22.04.
#
# See: https://wiki.debian.org/DebianRepository/UseThirdParty
- name: Create /etc/apt/keyrings
file:
path: /etc/apt/keyrings
mode: 0755
owner: root
group: root
state: directory
when: ansible_distribution_major_version is version('12', '<')
# Scaleway seems to use a weird sources.list format as of Debian 12? # Scaleway seems to use a weird sources.list format as of Debian 12?
- name: Check for weird Debian sources - name: Check for weird Debian sources
ansible.builtin.stat: ansible.builtin.stat:
@ -36,7 +22,6 @@
- iotop - iotop
- htop - htop
- strace - strace
- cron-apt
- safe-rm - safe-rm
- debian-goodies - debian-goodies
- mosh - mosh
@ -48,11 +33,12 @@
- zstd - zstd
- rsync - rsync
- lsof - lsof
- unattended-upgrades
- name: Install base packages - name: Install base packages
ansible.builtin.apt: name={{ base_packages }} state=present cache_valid_time=3600 ansible.builtin.apt: name={{ base_packages }} state=present cache_valid_time=3600
- name: Configure cron-apt - name: Remove cron-apt
ansible.builtin.import_tasks: cron-apt.yml ansible.builtin.import_tasks: cron-apt.yml
tags: cron-apt tags: cron-apt

80
roles/common/tasks/packages_Ubuntu.yml
View File

@ -1,20 +1,6 @@
--- ---
- name: Configure Ubuntu packages - name: Configure Ubuntu packages
block: block:
# Create directory for third-party package signing keys. Required on distros
# older than Debian 12 / Ubuntu 22.04.
#
# See: https://wiki.debian.org/DebianRepository/UseThirdParty
- name: Create /etc/apt/keyrings
file:
path: /etc/apt/keyrings
mode: 0755
owner: root
group: root
state: directory
when: ansible_distribution_major_version is version('22.04', '<')
- name: Configure apt mirror - name: Configure apt mirror
ansible.builtin.template: src=sources.list.j2 dest=/etc/apt/sources.list owner=root group=root mode=0644 ansible.builtin.template: src=sources.list.j2 dest=/etc/apt/sources.list owner=root group=root mode=0644
when: ansible_architecture != 'armv7l' when: ansible_architecture != 'armv7l'
@ -25,59 +11,27 @@
- name: Set Ubuntu base packages - name: Set Ubuntu base packages
ansible.builtin.set_fact: ansible.builtin.set_fact:
ubuntu_base_packages: ubuntu_base_packages:
- git - git
- git-lfs - git-lfs
- tmux - tmux
- iotop - iotop
- htop - htop
- strace - strace
- cron-apt - cron-apt
- safe-rm - safe-rm
- debian-goodies - debian-goodies
- mosh - mosh
- python-pycurl # for ansible's apt_repository - python-pycurl # for ansible's apt_repository
- vim - vim
- unzip - unzip
- apt-transport-https # for https support in apt - apt-transport-https # for https support in apt
- zstd - zstd
- rsync - rsync
- lsof - lsof
- name: Install base packages - name: Install base packages
ansible.builtin.apt: pkg={{ ubuntu_base_packages }} state=present cache_valid_time=3600 ansible.builtin.apt: pkg={{ ubuntu_base_packages }} state=present cache_valid_time=3600
# We have to remove snaps one by one in a specific order because some depend
# on others. Only after that can we remove the corresponding system packages.
- name: Remove lxd snap
community.general.snap: name=lxd state=absent
when: ansible_distribution_version is version('20.04', '==')
ignore_errors: true
- name: Remove core18 snap
community.general.snap: name=core18 state=absent
when: ansible_distribution_version is version('20.04', '==')
ignore_errors: true
- name: Remove snapd snap
community.general.snap: name=snapd state=absent
when: ansible_distribution_version is version('20.04', '==')
ignore_errors: true
- name: Set fact for packages to remove (Ubuntu 20.04)
ansible.builtin.set_fact:
ubuntu_annoying_packages:
- whoopsie # security (CIS 4.1)
- apport # security (CIS 4.1)
- command-not-found # annoying
- command-not-found-data # annoying
- python3-commandnotfound # annoying
- snapd # annoying (Ubuntu >= 16.04)
- lxd-agent-loader # annoying (Ubuntu 20.04)
when: ansible_distribution_version is version('20.04', '==')
- name: Remove packages
ansible.builtin.apt: name={{ ubuntu_annoying_packages }} state=absent purge=true
- name: Disable annoying Canonical spam in MOTD - name: Disable annoying Canonical spam in MOTD
ansible.builtin.file: path={{ item }} mode=0644 state=absent ansible.builtin.file: path={{ item }} mode=0644 state=absent
loop: loop:

2
roles/common/tasks/ssh-keys.yml
View File

@ -3,7 +3,7 @@
ansible.builtin.file: dest={{ provisioning_user.home }}/.ssh/authorized_keys state=absent ansible.builtin.file: dest={{ provisioning_user.home }}/.ssh/authorized_keys state=absent
- name: Add public keys to authorized_keys - name: Add public keys to authorized_keys
ansible.posix.authorized_key: { user: '{{ provisioning_user.name }}', key: "{{ lookup('file',item) }}" } ansible.posix.authorized_key: { user: "{{ provisioning_user.name }}", key: "{{ lookup('file',item) }}" }
with_fileglob: with_fileglob:
# use descriptive names for keys, like: aorth-mzito-rsa.pub # use descriptive names for keys, like: aorth-mzito-rsa.pub
- ssh-pub-keys/*.pub - ssh-pub-keys/*.pub

4
roles/common/tasks/sshd.yml
View File

@ -1,8 +1,8 @@
--- ---
# SSH configs don't change in Debian minor versions # SSH configs don't change in Debian minor versions
- name: Reconfigure /etc/ssh/sshd_config - name: Reconfigure /etc/ssh/sshd_config
ansible.builtin.template: src=sshd_config_{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.j2 dest=/etc/ssh/sshd_config owner=root group=root mode=0600 ansible.builtin.template: src=sshd_config_{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.j2 dest=/etc/ssh/sshd_config owner=root group=root
mode=0600
when: ansible_distribution == 'Debian' when: ansible_distribution == 'Debian'
notify: reload sshd notify: reload sshd

45
roles/common/tasks/tarsnap.yml
View File

@ -1,24 +1,45 @@
--- ---
- name: Add Tarsnap apt mirror - name: Check tarsnap apt signing key
ansible.builtin.template: src=tarsnap_sources.list.j2 dest=/etc/apt/sources.list.d/tarsnap.list owner=root group=root mode=0644 ansible.builtin.stat:
path: /etc/apt/keyrings/tarsnap-deb-packaging-key.asc
register: tarsnap_signing_key_stat
- name: Download tarsnap apt signing key
ansible.builtin.get_url:
url: https://pkg.tarsnap.com/tarsnap-deb-packaging-key.asc
dest: /etc/apt/keyrings/tarsnap-deb-packaging-key.asc
owner: root
group: root
mode: "0644"
register: download_tarsnap_signing_key
when: not tarsnap_signing_key_stat.stat.exists
- name: Add tarsnap.org repo
ansible.builtin.template:
src: tarsnap_sources.list.j2
dest: /etc/apt/sources.list.d/tarsnap.list
owner: root
group: root
mode: "0644"
register: add_tarsnap_apt_repository register: add_tarsnap_apt_repository
when: ansible_architecture != 'armv7l' when: ansible_architecture != 'armv7l'
- name: Add GPG key for Tarsnap
ansible.builtin.apt_key: id=0xF608BA1BFB5CE8F8CAB088359F084BEE7F938A76 url=https://pkg.tarsnap.com/tarsnap-deb-packaging-key.asc state=present
register: add_tarsnap_apt_key
- name: Update apt cache - name: Update apt cache
ansible.builtin.apt: ansible.builtin.apt: # noqa no-handler
update_cache: true update_cache: true
when: when: (download_tarsnap_signing_key.status_code is defined and download_tarsnap_signing_key.status_code == 200) or add_tarsnap_apt_repository is changed
add_tarsnap_apt_key is changed or
add_tarsnap_apt_repository is changed
- name: Install tarsnap - name: Install tarsnap
ansible.builtin.apt: pkg=tarsnap cache_valid_time=3600 ansible.builtin.apt:
pkg: tarsnap
cache_valid_time: 3600
- name: Copy tarsnaprc - name: Copy tarsnaprc
ansible.builtin.copy: src=tarsnaprc dest=/root/.tarsnaprc owner=root group=root mode=0600 ansible.builtin.copy:
src: tarsnaprc
dest: /root/.tarsnaprc
owner: root
group: root
mode: "0600"
# vim: set sw=2 ts=2: # vim: set sw=2 ts=2:

53
roles/common/templates/nftables.conf.j2
View File

@ -5,47 +5,18 @@
flush ruleset flush ruleset
# Lists updated daily by update-spamhaus-nftables.sh # List updated daily by update-firehol-nftables.sh
include "/etc/nftables/spamhaus-ipv4.nft" include "/etc/nftables/firehol_level1-ipv4.nft"
include "/etc/nftables/spamhaus-ipv6.nft"
# Lists updated monthly (manually)
include "/etc/nftables/abuseipdb-ipv4.nft"
include "/etc/nftables/abuseipdb-ipv6.nft"
# Lists updated daily by update-abusech-nftables.sh
include "/etc/nftables/abusech-ipv4.nft"
# Notes: # Notes:
# - tables hold chains, chains hold rules # - tables hold chains, chains hold rules
# - inet is for both ipv4 and ipv6 # - inet is for both ipv4 and ipv6
table inet filter { table inet filter {
set spamhaus-ipv4 { set firehol_level1-ipv4 {
type ipv4_addr type ipv4_addr
# if the set contains prefixes we need to use the interval flag # if the set contains prefixes we need to use the interval flag
flags interval flags interval
elements = $SPAMHAUS_IPV4 elements = $FIREHOL_LEVEL1_IPV4
}
set spamhaus-ipv6 {
type ipv6_addr
flags interval
elements = $SPAMHAUS_IPV6
}
set abusech-ipv4 {
type ipv4_addr
elements = $ABUSECH_IPV4
}
set abuseipdb-ipv4 {
type ipv4_addr
elements = $ABUSEIPDB_IPV4
}
set abuseipdb-ipv6 {
type ipv6_addr
elements = $ABUSEIPDB_IPV6
} }
chain input { chain input {
@ -55,13 +26,7 @@ table inet filter {
ct state invalid counter drop comment "Early drop of invalid connections" ct state invalid counter drop comment "Early drop of invalid connections"
ip saddr @spamhaus-ipv4 counter drop comment "Early drop of incoming packets matching spamhaus-ipv4 list" ip saddr @firehol_level1-ipv4 counter drop comment "Early drop of incoming packets matching firehol_level1-ipv4 list"
ip6 saddr @spamhaus-ipv6 counter drop comment "Early drop of incoming packets matching spamhaus-ipv6 list"
ip saddr @abusech-ipv4 counter drop comment "Early drop of packets matching abusech-ipv4 list"
ip saddr @abuseipdb-ipv4 counter drop comment "Early drop of incoming packets matching abuseipdb-ipv4 list"
ip6 saddr @abuseipdb-ipv6 counter drop comment "Early drop of incoming packets matching abuseipdb-ipv6 list"
iifname lo accept comment "Allow from loopback" iifname lo accept comment "Allow from loopback"
@ -105,12 +70,6 @@ table inet filter {
chain output { chain output {
type filter hook output priority 0; type filter hook output priority 0;
ip daddr @spamhaus-ipv4 counter drop comment "Drop outgoing packets matching spamhaus-ipv4 list" ip daddr @firehol_level1-ipv4 counter drop comment "Drop outgoing packets matching firehol_level1-ipv4 list"
ip6 daddr @spamhaus-ipv6 counter drop comment "Drop outgoing packets matching spamhaus-ipv6 list"
ip daddr @abusech-ipv4 counter drop comment "Drop outgoing packets matching abusech-ipv4 list"
ip daddr @abuseipdb-ipv4 counter drop comment "Drop outgoing packets matching abuseipdb-ipv4 list"
ip6 daddr @abuseipdb-ipv6 counter drop comment "Drop outgoing packets matching abuseipdb-ipv6 list"
} }
} }

5
roles/common/templates/security.sources.list.j2
View File

@ -1,5 +0,0 @@
{% if ansible_distribution == 'Ubuntu' %}
deb http://security.ubuntu.com/ubuntu {{ ansible_distribution_release }}-security main restricted universe multiverse
{% elif ansible_distribution == 'Debian' %}
deb http://security.debian.org/debian-security {{ ansible_distribution_release }}/updates main contrib non-free
{% endif %}

2
roles/common/templates/tarsnap_sources.list.j2
View File

@ -1 +1 @@
deb [arch=amd64] https://pkg.tarsnap.com/deb/{{ ansible_distribution_release }} ./ deb [arch=amd64 signed-by=/etc/apt/keyrings/tarsnap-deb-packaging-key.asc] https://pkg.tarsnap.com/deb/{{ ansible_distribution_release }} ./

65
roles/common/templates/update-firehol-nftables.sh.j2 Executable file
View File

@ -0,0 +1,65 @@
#!/usr/bin/env bash
#
# update-firehol-nftables.sh v0.0.1
#
# Download FireHOL lists and load them into nftables sets.
#
# See: https://iplists.firehol.org/
#
# Copyright (C) 2025 Alan Orth
#
# SPDX-License-Identifier: GPL-3.0-only
# Exit on first error
set -o errexit
firehol_level1_ipv4_set_path=/etc/nftables/firehol_level1-ipv4.nft
function download() {
echo "Downloading $1"
wget -q -O - "https://iplists.firehol.org/files/$1" > "$1"
}
download firehol_level1.netset
if [[ -f "firehol_level1.netset" ]]; then
echo "Processing FireHOL Level 1 list"
firehol_level1_ipv4_list_temp=$(mktemp)
firehol_level1_ipv4_set_temp=$(mktemp)
# Filter blank lines, comments, and bogons we use inside the LAN, DMZ, and
# for local services like systemd-resolved and others on localhost. Ideally
# these are blocked already at the WAN side by network administrators.
cat firehol_level1.netset \
| sed \
-e '/^$/d' \
-e '/^#.*/d' \
-e '/^127\.0\.0\.0\/8/d' \
> "$firehol_level1_ipv4_list_temp"
echo "Building firehol_level1-ipv4 set"
cat << NFT_HEAD > "$firehol_level1_ipv4_set_temp"
#!/usr/sbin/nft -f
define FIREHOL_LEVEL1_IPV4 = {
NFT_HEAD
while read -r network; do
# nftables doesn't mind if the last element in the set has a trailing
# comma so we don't need to do anything special here.
echo "$network," >> "$firehol_level1_ipv4_set_temp"
done < $firehol_level1_ipv4_list_temp
echo "}" >> "$firehol_level1_ipv4_set_temp"
install -m 0600 "$firehol_level1_ipv4_set_temp" "$firehol_level1_ipv4_set_path"
rm -f "$firehol_level1_ipv4_list_temp" "$firehol_level1_ipv4_set_temp"
fi
echo "Reloading nftables"
/usr/bin/systemctl reload nftables.service
rm -v firehol_level1.netset

19
roles/mariadb/tasks/main.yml
View File

@ -1,7 +1,7 @@
--- ---
- name: Remove MariaDB key from apt-key - name: Remove MariaDB key from apt-key
ansible.builtin.apt_key: ansible.builtin.apt_key:
id: 0x177F4010FE56CA3336300305F1656F24C74CD1D8 id: "013577200103762554506315430003013705453362230723150730"
state: absent state: absent
tags: tags:
- packages - packages
@ -21,16 +21,17 @@
dest: /etc/apt/keyrings/mariadb_release_signing_key.asc dest: /etc/apt/keyrings/mariadb_release_signing_key.asc
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
register: download_mariadb_signing_key register: download_mariadb_signing_key
when: not mariadb_signing_key_stat.stat.exists when: not mariadb_signing_key_stat.stat.exists
tags: tags:
- packages - packages
- mariadb - mariadb
- name: Add MariaDB 10.6 repo - name: Add MariaDB 10.11 repo
ansible.builtin.apt_repository: ansible.builtin.apt_repository:
repo: 'deb [arch=amd64 signed-by=/etc/apt/keyrings/mariadb_release_signing_key.asc] https://dlm.mariadb.com/repo/mariadb-server/10.6/repo/debian {{ ansible_distribution_release }} main' repo: deb [arch=amd64 signed-by=/etc/apt/keyrings/mariadb_release_signing_key.asc] https://dlm.mariadb.com/repo/mariadb-server/10.11/repo/debian {{ ansible_distribution_release
}} main
filename: mariadb filename: mariadb
state: present state: present
register: add_mariadb_apt_repository register: add_mariadb_apt_repository
@ -41,16 +42,14 @@
- name: Update apt cache - name: Update apt cache
ansible.builtin.apt: # noqa no-handler ansible.builtin.apt: # noqa no-handler
update_cache: true update_cache: true
when: when: (download_mariadb_signing_key.status_code is defined and download_mariadb_signing_key.status_code == 200) or add_mariadb_apt_repository is changed
(download_mariadb_signing_key.status_code is defined and download_mariadb_signing_key.status_code == 200) or
add_mariadb_apt_repository is changed
tags: tags:
- packages - packages
- mariadb - mariadb
- name: Install mariadb-server - name: Install mariadb-server
ansible.builtin.apt: ansible.builtin.apt:
name: ['mariadb-server', 'python3-pymysql'] name: [mariadb-server, python3-pymysql]
state: present state: present
cache_valid_time: 3600 cache_valid_time: 3600
tags: mariadb, packages tags: mariadb, packages
@ -61,7 +60,7 @@
dest: /etc/mysql/my.cnf dest: /etc/mysql/my.cnf
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
notify: notify:
- restart mariadb - restart mariadb
tags: mariadb tags: mariadb
@ -83,7 +82,7 @@
src: .my.cnf.j2 src: .my.cnf.j2
dest: /root/.my.cnf dest: /root/.my.cnf
owner: root owner: root
mode: 0600 mode: "0600"
tags: mariadb tags: mariadb
# See: https://docs.ansible.com/ansible/latest/collections/community/mysql/mysql_db_module.html # See: https://docs.ansible.com/ansible/latest/collections/community/mysql/mysql_db_module.html

18
roles/nginx/defaults/main.yml
View File

@ -5,20 +5,20 @@
nginx_confd_path: /etc/nginx/conf.d nginx_confd_path: /etc/nginx/conf.d
# parent directory of vhost roots # parent directory of vhost roots
nginx_root_prefix: /var/www nginx_root_prefix: "{{ web_root_prefix }}"
# 1 hour timeout # 1 day timeout
nginx_ssl_session_timeout: 1h nginx_ssl_session_timeout: 1d
# 10MB -> 40,000 sessions # 10MB -> 40,000 sessions
nginx_ssl_session_cache: shared:SSL:10m nginx_ssl_session_cache: shared:SSL:10m
# 1400 bytes to fit in one MTU (default is 16k!) nginx_ssl_buffer_size: 4k
nginx_ssl_buffer_size: 1400
nginx_ssl_dhparam: /etc/ssl/certs/dhparam.pem nginx_ssl_dhparam: /etc/ssl/certs/dhparam.pem
nginx_ssl_protocols: 'TLSv1.2 TLSv1.3' nginx_ssl_protocols: TLSv1.2 TLSv1.3
nginx_ssl_ecdh_curve: X25519:prime256v1:secp384r1
# DNS resolvers for OCSP stapling (default to Cloudflare public DNS) # DNS resolvers for OCSP stapling (default to Cloudflare public DNS)
# See: https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling # See: https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling
nginx_ssl_stapling_resolver: '1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001]' nginx_ssl_stapling_resolver: 1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001]
# HTTP Strict-Transport-Security header, recommended by Google to be ~1 year # HTTP Strict-Transport-Security header, recommended by Google to be ~1 year
# in seconds, see: https://hstspreload.org/ # in seconds, see: https://hstspreload.org/
@ -37,8 +37,8 @@ letsencrypt_root: /etc/ssl
letsencrypt_acme_script_temp: /root/acme.sh letsencrypt_acme_script_temp: /root/acme.sh
letsencrypt_acme_home: /root/.acme.sh letsencrypt_acme_home: /root/.acme.sh
# stable is 1.20.x # stable is 1.26.x
# mainline is 1.21.x # mainline is 1.27.x
nginx_version: mainline nginx_version: mainline
# vim: set ts=2 sw=2: # vim: set ts=2 sw=2:

145
roles/nginx/tasks/letsencrypt.yml
View File

@ -1,91 +1,90 @@
--- ---
# Use acme.sh instead of certbot because they only support installation via # Use acme.sh instead of certbot because they only support installation via
# snap now. # snap now.
- block: - block:
- name: Remove certbot - name: Remove certbot
ansible.builtin.apt: ansible.builtin.apt:
name: certbot name: certbot
state: absent state: absent
- name: Remove old certbot post and pre hooks for nginx - name: Remove old certbot post and pre hooks for nginx
ansible.builtin.file: ansible.builtin.file:
dest: "{{ item }}" dest: "{{ item }}"
state: absent state: absent
with_items: with_items:
- /etc/letsencrypt/renewal-hooks/pre/stop-nginx.sh - /etc/letsencrypt/renewal-hooks/pre/stop-nginx.sh
- /etc/letsencrypt/renewal-hooks/post/start-nginx.sh - /etc/letsencrypt/renewal-hooks/post/start-nginx.sh
- name: Check if acme.sh is installed - name: Check if acme.sh is installed
ansible.builtin.stat: ansible.builtin.stat:
path: "{{ letsencrypt_acme_home }}" path: "{{ letsencrypt_acme_home }}"
register: acme_home register: acme_home
- name: Download acme.sh - name: Download acme.sh
ansible.builtin.get_url: ansible.builtin.get_url:
url: https://raw.githubusercontent.com/acmesh-official/acme.sh/master/acme.sh url: https://raw.githubusercontent.com/acmesh-official/acme.sh/master/acme.sh
dest: "{{ letsencrypt_acme_script_temp }}" dest: "{{ letsencrypt_acme_script_temp }}"
mode: 0700 mode: "0700"
register: acme_download register: acme_download
when: not acme_home.stat.exists when: not acme_home.stat.exists
# Run the "install" for acme.sh so it creates the .acme.sh dir (currently I # Run the "install" for acme.sh so it creates the .acme.sh dir (currently I
# have to chdir to the /root directory where the script exists or else it # have to chdir to the /root directory where the script exists or else it
# fails. Ansible runs it, but the script can't find itself...). # fails. Ansible runs it, but the script can't find itself...).
- name: Install acme.sh - name: Install acme.sh
ansible.builtin.command: ansible.builtin.command:
cmd: "{{ letsencrypt_acme_script_temp }} --install --no-profile --no-cron" cmd: "{{ letsencrypt_acme_script_temp }} --install --no-profile --no-cron"
creates: "{{ letsencrypt_acme_home }}/acme.sh" creates: "{{ letsencrypt_acme_home }}/acme.sh"
chdir: /root chdir: /root
register: acme_install register: acme_install
when: acme_download is changed when: acme_download is changed
- name: Remove temporary acme.sh script - name: Remove temporary acme.sh script
ansible.builtin.file: ansible.builtin.file:
dest: "{{ letsencrypt_acme_script_temp }}" dest: "{{ letsencrypt_acme_script_temp }}"
state: absent state: absent
when: when:
- acme_install.rc is defined - acme_install.rc is defined
- acme_install.rc == 0 - acme_install.rc == 0
- name: Set default certificate authority for acme.sh - name: Set default certificate authority for acme.sh
ansible.builtin.command: ansible.builtin.command:
cmd: "{{ letsencrypt_acme_home }}/acme.sh --set-default-ca --server letsencrypt" cmd: "{{ letsencrypt_acme_home }}/acme.sh --set-default-ca --server letsencrypt"
- name: Prepare Let's Encrypt well-known directory - name: Prepare Let's Encrypt well-known directory
ansible.builtin.file: ansible.builtin.file:
state: directory state: directory
path: /var/lib/letsencrypt/.well-known path: /var/lib/letsencrypt/.well-known
owner: root owner: root
group: nginx group: nginx
mode: g+s mode: g+s
- name: Copy systemd service to renew Let's Encrypt certs - name: Copy systemd service to renew Let's Encrypt certs
ansible.builtin.template: ansible.builtin.template:
src: renew-letsencrypt.service.j2 src: renew-letsencrypt.service.j2
dest: /etc/systemd/system/renew-letsencrypt.service dest: /etc/systemd/system/renew-letsencrypt.service
mode: 0644 mode: "0644"
owner: root owner: root
group: root group: root
- name: Copy systemd timer to renew Let's Encrypt certs - name: Copy systemd timer to renew Let's Encrypt certs
ansible.builtin.copy: ansible.builtin.copy:
src: renew-letsencrypt.timer src: renew-letsencrypt.timer
dest: /etc/systemd/system/renew-letsencrypt.timer dest: /etc/systemd/system/renew-letsencrypt.timer
mode: 0644 mode: "0644"
owner: root owner: root
group: root group: root
# always issues daemon-reload just in case the service/timer changed # always issues daemon-reload just in case the service/timer changed
- name: Start and enable systemd timer to renew Let's Encrypt certs - name: Start and enable systemd timer to renew Let's Encrypt certs
ansible.builtin.systemd: ansible.builtin.systemd:
name: renew-letsencrypt.timer name: renew-letsencrypt.timer
state: started state: started
enabled: true enabled: true
daemon_reload: true daemon_reload: true
when: (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==')) when: (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==')) or (ansible_distribution == 'Debian' and ansible_distribution_version
or (ansible_distribution == 'Debian' and ansible_distribution_version is version('11', '==')) is version('11', '>='))
tags: letsencrypt tags: letsencrypt
# vim: set ts=2 sw=2: # vim: set ts=2 sw=2:

32
roles/nginx/tasks/main.yml
View File

@ -1,29 +1,21 @@
--- ---
- name: Remove nginx apt signing key from apt-key - name: Remove nginx apt signing key from apt-key
ansible.builtin.apt_key: ansible.builtin.apt_key:
id: 0x573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62 id: "053473772654754373614404074646527257655730117366337542"
state: absent state: absent
tags: tags:
- packages - packages
- nginx - nginx
- name: Check nginx apt signing key
ansible.builtin.stat:
path: /usr/share/keyrings/nginx_signing.key
register: nginx_signing_key_stat
tags:
- packages
- nginx
- name: Download nginx apt signing key - name: Download nginx apt signing key
ansible.builtin.get_url: ansible.builtin.get_url:
url: https://nginx.org/keys/nginx_signing.key url: https://nginx.org/keys/nginx_signing.key
dest: /usr/share/keyrings/nginx_signing.key dest: /usr/share/keyrings/nginx_signing.key
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
checksum: sha256:55385da31d198fa6a5012d40ae98ecb272a6c4e8fffffba94719ffd3e87de37a
register: download_nginx_signing_key register: download_nginx_signing_key
when: not nginx_signing_key_stat.stat.exists
tags: tags:
- packages - packages
- nginx - nginx
@ -34,7 +26,7 @@
dest: /etc/apt/sources.list.d/nginx_org_sources.list dest: /etc/apt/sources.list.d/nginx_org_sources.list
owner: root owner: root
group: root group: root
mode: 0644 mode: "0644"
register: add_nginx_apt_repository register: add_nginx_apt_repository
tags: tags:
- nginx - nginx
@ -43,9 +35,7 @@
- name: Update apt cache - name: Update apt cache
ansible.builtin.apt: # noqa no-handler ansible.builtin.apt: # noqa no-handler
update_cache: true update_cache: true
when: when: (download_nginx_signing_key.status_code is defined and download_nginx_signing_key.status_code == 200) or add_nginx_apt_repository is changed
(download_nginx_signing_key.status_code is defined and download_nginx_signing_key.status_code == 200) or
add_nginx_apt_repository is changed
- name: Install nginx - name: Install nginx
ansible.builtin.apt: ansible.builtin.apt:
@ -60,7 +50,7 @@
ansible.builtin.template: ansible.builtin.template:
src: nginx.conf.j2 src: nginx.conf.j2
dest: /etc/nginx/nginx.conf dest: /etc/nginx/nginx.conf
mode: 0644 mode: "0644"
owner: root owner: root
group: root group: root
notify: notify:
@ -70,8 +60,8 @@
- name: Copy extra nginx configs - name: Copy extra nginx configs
ansible.builtin.copy: ansible.builtin.copy:
src: "{{ item }}" src: "{{ item }}"
dest: "/etc/nginx/{{ item }}" dest: /etc/nginx/{{ item }}
mode: 0644 mode: "0644"
owner: root owner: root
group: root group: root
loop: loop:
@ -93,7 +83,7 @@
state: directory state: directory
owner: nginx owner: nginx
group: nginx group: nginx
mode: 0755 mode: "0755"
tags: nginx tags: nginx
- name: Configure nginx virtual hosts - name: Configure nginx virtual hosts
@ -110,7 +100,7 @@
ansible.builtin.template: ansible.builtin.template:
src: blank-vhost.conf.j2 src: blank-vhost.conf.j2
dest: "{{ nginx_confd_path }}/blank-vhost.conf" dest: "{{ nginx_confd_path }}/blank-vhost.conf"
mode: 0644 mode: "0644"
owner: root owner: root
group: root group: root
notify: notify:
@ -121,7 +111,7 @@
ansible.builtin.copy: ansible.builtin.copy:
src: munin.conf src: munin.conf
dest: /etc/nginx/conf.d/munin.conf dest: /etc/nginx/conf.d/munin.conf
mode: 0644 mode: "0644"
owner: root owner: root
group: root group: root
notify: notify:

42
roles/nginx/tasks/vhosts.yml
View File

@ -1,29 +1,29 @@
--- ---
- block: - block:
- name: Configure https vhosts - name: Configure https vhosts
ansible.builtin.template: src=vhost.conf.j2 dest={{ nginx_confd_path }}/{{ item.domain_name }}.conf mode=0644 owner=root group=root ansible.builtin.template: src=vhost.conf.j2 dest={{ nginx_confd_path }}/{{ item.domain_name }}.conf mode=0644 owner=root group=root
loop: "{{ nginx_vhosts }}" loop: "{{ nginx_vhosts }}"
notify: notify:
- reload nginx - reload nginx
- name: Generate self-signed TLS cert - name: Generate self-signed TLS cert
ansible.builtin.command: openssl req -x509 -nodes -sha256 -days 365 -subj "/C=SO/ST=SO/L=snakeoil/O=snakeoil/CN=snakeoil" -newkey rsa:2048 -keyout /etc/ssl/private/nginx-snakeoil.key -out /etc/ssl/certs/nginx-snakeoil.crt -extensions v3_ca creates=/etc/ssl/certs/nginx-snakeoil.crt ansible.builtin.command: openssl req -x509 -nodes -sha256 -days 365 -subj "/C=SO/ST=SO/L=snakeoil/O=snakeoil/CN=snakeoil" -newkey rsa:2048 -keyout /etc/ssl/private/nginx-snakeoil.key
notify: -out /etc/ssl/certs/nginx-snakeoil.crt -extensions v3_ca creates=/etc/ssl/certs/nginx-snakeoil.crt
- reload nginx notify:
- reload nginx
- name: Download 4096-bit RFC 7919 dhparams - name: Download 4096-bit RFC 7919 dhparams
ansible.builtin.get_url: ansible.builtin.get_url:
url: https://raw.githubusercontent.com/internetstandards/dhe_groups/master/ffdhe4096.pem url: https://raw.githubusercontent.com/internetstandards/dhe_groups/master/ffdhe4096.pem
checksum: sha256:64852d6890ff9e62eecd1ee89c72af9af244dfef5b853bcedea3dfd7aade22b3 checksum: sha256:64852d6890ff9e62eecd1ee89c72af9af244dfef5b853bcedea3dfd7aade22b3
dest: "{{ nginx_ssl_dhparam }}" dest: "{{ nginx_ssl_dhparam }}"
notify: notify:
- reload nginx - reload nginx
# TODO: this could break because we can override the document root in host vars # TODO: this could break because we can override the document root in host vars
- name: Create vhost document roots - name: Create vhost document roots
ansible.builtin.file: path={{ nginx_root_prefix }}/{{ item.domain_name }} state=directory mode=0755 owner=nginx group=nginx ansible.builtin.file: path={{ nginx_root_prefix }}/{{ item.domain_name }} state=directory mode=0755 owner=nginx group=nginx
loop: "{{ nginx_vhosts }}" loop: "{{ nginx_vhosts }}"
tags: nginx tags: nginx
# vim: set ts=2 sw=2: # vim: set ts=2 sw=2:

26
roles/nginx/tasks/wordpress.yml
View File

@ -1,19 +1,19 @@
--- ---
- block: - block:
- name: Install WordPress - name: Install WordPress
ansible.builtin.git: repo=https://github.com/WordPress/WordPress.git dest={{ nginx_root_prefix }}/{{ item.domain_name }}/wordpress version={{ item.wordpress_version }} depth=1 force=true ansible.builtin.git: repo=https://github.com/WordPress/WordPress.git dest={{ nginx_root_prefix }}/{{ item.domain_name }}/wordpress version={{ item.wordpress_version
when: }} depth=1 force=true
- item.has_wordpress is defined when:
- item.has_wordpress - item.has_wordpress is defined
loop: "{{ nginx_vhosts }}" - item.has_wordpress
loop: "{{ nginx_vhosts }}"
- name: Fix WordPress directory permissions - name: Fix WordPress directory permissions
ansible.builtin.file: path={{ nginx_root_prefix }}/{{ item.domain_name }} state=directory owner=nginx group=nginx recurse=true ansible.builtin.file: path={{ nginx_root_prefix }}/{{ item.domain_name }} state=directory owner=nginx group=nginx recurse=true
when: when:
- item.has_wordpress is defined - item.has_wordpress is defined
- item.has_wordpress - item.has_wordpress
loop: "{{ nginx_vhosts }}" loop: "{{ nginx_vhosts }}"
tags: wordpress tags: wordpress
# vim: set ts=2 sw=2: # vim: set ts=2 sw=2:

6
roles/nginx/templates/blank-vhost.conf.j2
View File

@ -11,9 +11,11 @@ server {
return 444; return 444;
} }
server { server {
listen 443 ssl http2 default_server; listen 443 ssl default_server;
listen [::]:443 ssl http2 default_server; listen [::]:443 ssl default_server;
http2 on;
server_name _; server_name _;
# self-signed "snakeoil" certificate # self-signed "snakeoil" certificate

12
roles/nginx/templates/https.j2
View File

@ -27,8 +27,9 @@
ssl_dhparam {{ nginx_ssl_dhparam }}; ssl_dhparam {{ nginx_ssl_dhparam }};
ssl_protocols {{ nginx_ssl_protocols }}; ssl_protocols {{ nginx_ssl_protocols }};
ssl_ecdh_curve {{ nginx_ssl_ecdh_curve }};
ssl_ciphers "{{ tls_cipher_suite }}"; ssl_ciphers "{{ tls_cipher_suite }}";
ssl_prefer_server_ciphers on; ssl_prefer_server_ciphers off;
{# OSCP stapling only works with real certs #} {# OSCP stapling only works with real certs #}
{% if use_letsencrypt == true or item.tls_certificate_path %} {% if use_letsencrypt == true or item.tls_certificate_path %}
@ -38,15 +39,6 @@
resolver {{ nginx_ssl_stapling_resolver }}; resolver {{ nginx_ssl_stapling_resolver }};
{% endif %} {# end: use_letsencrypt #} {% endif %} {# end: use_letsencrypt #}
# nginx does not auto-rotate session ticket keys: only a HUP / restart will do so and
# when a restart is performed the previous key is lost, which resets all previous
# sessions. The fix for this is to setup a manual rotation mechanism:
# http://trac.nginx.org/nginx/changeset/1356a3b9692441e163b4e78be4e9f5a46c7479e9/nginx
#
# Note that you'll have to define and rotate the keys securely by yourself. In absence
# of such infrastructure, consider turning off session tickets:
ssl_session_tickets off;
{% if enable_hsts == true %} {% if enable_hsts == true %}
# Enable this if you want HSTS (recommended, but be careful) # Enable this if you want HSTS (recommended, but be careful)
# Include all subdomains and indicate to Google that we want this pre-loaded in Chrome's HSTS store # Include all subdomains and indicate to Google that we want this pre-loaded in Chrome's HSTS store

24
roles/nginx/templates/vhost.conf.j2
View File

@ -8,6 +8,12 @@
{% set has_wordpress = item.has_wordpress | default(false) %} {% set has_wordpress = item.has_wordpress | default(false) %}
{% set needs_php = item.needs_php | default(false) %} {% set needs_php = item.needs_php | default(false) %}
{% set has_gitea = item.has_gitea | default(false) %} {% set has_gitea = item.has_gitea | default(false) %}
{# Allow sites to override the document root #}
{% if item.document_root is defined %}
{% set document_root = item.document_root %}
{% else %}
{% set document_root = (nginx_root_prefix, domain_name) | ansible.builtin.path_join %}
{% endif %}
# http -> https vhost # http -> https vhost
server { server {
@ -26,15 +32,11 @@ server {
} }
server { server {
listen 443 ssl http2; listen 443 ssl;
listen [::]:443 ssl http2; listen [::]:443 ssl;
http2 on;
{# Allow sites to override the nginx document root #} root {{ document_root }};
{% if item.document_root is defined %}
root {{ item.document_root }};
{% else %}
root {{ nginx_root_prefix }}/{{ domain_name }};
{% endif %}
{# will only work if the TLS cert covers the domain + aliases, like example.com and www.example.com #} {# will only work if the TLS cert covers the domain + aliases, like example.com and www.example.com #}
server_name {{ domain_name }} {{ domain_aliases }}; server_name {{ domain_name }} {{ domain_aliases }};
@ -75,10 +77,8 @@ server {
# See: https://httpoxy.org/ # See: https://httpoxy.org/
fastcgi_param HTTP_PROXY ""; fastcgi_param HTTP_PROXY "";
{% if (ansible_distribution == 'Ubuntu' and ansible_distribution_version is version('20.04', '==')) or (ansible_distribution == 'Debian' and ansible_distribution_major_version is version('11', '==')) %} {% if ansible_distribution == 'Debian' and ansible_distribution_major_version is version('12', '==') %}
fastcgi_pass unix:/run/php/php7.4-fpm-{{ domain_name }}.sock; fastcgi_pass unix:/run/php/php8.2-fpm-{{ domain_name }}.sock;
{% else %}
fastcgi_pass unix:/var/run/php5-fpm-{{ domain_name }}.sock;
{% endif %} {% endif %}
fastcgi_index index.php; fastcgi_index index.php;
# set script path relative to document root in server block # set script path relative to document root in server block

8
roles/php-fpm/handlers/main.yml
View File

@ -1,6 +1,8 @@
--- ---
# For Ubuntu 20.04 and Debian 11 # For Debian 12
- name: reload php7.4-fpm - name: reload php8.2-fpm
ansible.builtin.systemd: name=php7.4-fpm state=reloaded ansible.builtin.systemd:
name: php8.2-fpm
state: reloaded
# vim: set ts=2 sw=2: # vim: set ts=2 sw=2:

50
roles/php-fpm/tasks/Debian_12.yml Normal file
View File

@ -0,0 +1,50 @@
---
- block:
- name: Set php-fpm packages
ansible.builtin.set_fact:
php_fpm_packages:
- php8.2-fpm
# for WordPress
- php8.2-mysql
- php8.2-gd
- php8.2-curl
- php8.2-xml
- name: Install php-fpm and deps
ansible.builtin.apt:
name: "{{ php_fpm_packages }}"
state: present
update_cache: true
# only copy php-fpm config for vhosts that need WordPress or PHP
- name: Copy php-fpm pool config
ansible.builtin.template:
src: php8.2-pool.conf.j2
dest: /etc/php/8.2/fpm/pool.d/{{ item.domain_name }}.conf
owner: root
group: root
mode: "0644"
loop: "{{ nginx_vhosts }}"
when: (item.has_wordpress is defined and item.has_wordpress) or (item.needs_php is defined and item.needs_php)
notify: reload php8.2-fpm
- name: Remove default www pool
ansible.builtin.file:
path: /etc/php/8.2/fpm/pool.d/www.conf
state: absent
notify: reload php8.2-fpm
# re-configure php.ini
- name: Update php.ini
ansible.builtin.template:
src: php8.2-php.ini.j2
dest: /etc/php/8.2/fpm/php.ini
owner: root
group: root
mode: "0644"
notify: reload php8.2-fpm
tags: php-fpm
when: install_php
# vim: set ts=2 sw=2:

36
roles/php-fpm/tasks/Ubuntu_20.04.yml
View File

@ -1,36 +0,0 @@
---
- block:
- name: Set php-fpm packages
ansible.builtin.set_fact:
php_fpm_packages:
- php7.4-fpm
# for WordPress
- php7.4-mysql
- php7.4-gd
- php7.4-curl
- php7.4-xml
- name: Install php-fpm and deps
ansible.builtin.apt: name={{ php_fpm_packages }} state=present update_cache=true
# only copy php-fpm config for vhosts that need WordPress or PHP
- name: Copy php-fpm pool config
ansible.builtin.template: src=php7.4-pool.conf.j2 dest=/etc/php/7.4/fpm/pool.d/{{ item.domain_name }}.conf owner=root group=root mode=0644
loop: "{{ nginx_vhosts }}"
when: (item.has_wordpress is defined and item.has_wordpress) or (item.needs_php is defined and item.needs_php)
notify: reload php7.4-fpm
- name: Remove default www pool
ansible.builtin.file: path=/etc/php/7.4/fpm/pool.d/www.conf state=absent
notify: reload php7.4-fpm
# re-configure php.ini
- name: Update php.ini
ansible.builtin.template: src=php7.4-php.ini.j2 dest=/etc/php/7.4/fpm/php.ini owner=root group=root mode=0644
notify: reload php7.4-fpm
tags: php-fpm
when: install_php
# vim: set ts=2 sw=2:

23
roles/php-fpm/tasks/main.yml
View File

@ -1,6 +1,5 @@
--- ---
# Ubuntu 20.04 uses PHP 7.4 # Debian 12 uses PHP 8.2
# Debian 11 uses PHP 7.4
# If any of the vhosts on this host need WordPress then we need to install PHP. # If any of the vhosts on this host need WordPress then we need to install PHP.
# This uses selectattr to filter the list of dicts in nginx_vhosts, selecting # This uses selectattr to filter the list of dicts in nginx_vhosts, selecting
@ -10,13 +9,13 @@
- name: Check if any vhost needs WordPress - name: Check if any vhost needs WordPress
ansible.builtin.set_fact: ansible.builtin.set_fact:
install_php: true install_php: true
when: "nginx_vhosts | selectattr('has_wordpress', 'defined') | selectattr('has_wordpress', 'equalto', true) | list | length > 0" when: nginx_vhosts | selectattr('has_wordpress', 'defined') | selectattr('has_wordpress', 'equalto', true) | list | length > 0
# Legacy, was only for Piwik, but leaving for now. # Legacy, was only for Piwik, but leaving for now.
- name: Check if any vhost needs PHP - name: Check if any vhost needs PHP
ansible.builtin.set_fact: ansible.builtin.set_fact:
install_php: true install_php: true
when: "nginx_vhosts | selectattr('needs_php', 'defined') | selectattr('needs_php', 'equalto', true) | list | length > 0" when: nginx_vhosts | selectattr('needs_php', 'defined') | selectattr('needs_php', 'equalto', true) | list | length > 0
# If install_php has not been set, then we assume no vhosts need PHP. This is # If install_php has not been set, then we assume no vhosts need PHP. This is
# a bit hacky, but it's the closest we come to an if/then/else. # a bit hacky, but it's the closest we come to an if/then/else.
@ -25,20 +24,12 @@
install_php: false install_php: false
when: install_php is not defined when: install_php is not defined
- name: Configure php-fpm on Ubuntu 20.04 - name: Configure php-fpm on Debian 12
ansible.builtin.include_tasks: Ubuntu_20.04.yml ansible.builtin.include_tasks: Debian_12.yml
when:
- ansible_distribution == 'Ubuntu'
- ansible_distribution_version is version('20.04', '==')
- install_php == true
tags: php-fpm
- name: Configure php-fpm on Debian 11
ansible.builtin.include_tasks: Ubuntu_20.04.yml
when: when:
- ansible_distribution == 'Debian' - ansible_distribution == 'Debian'
- ansible_distribution_major_version is version('11', '==') - ansible_distribution_major_version is version('12', '==')
- install_php == true - install_php
tags: php-fpm tags: php-fpm
# vim: set ts=2 sw=2: # vim: set ts=2 sw=2:

561
roles/php-fpm/templates/php7.4-php.ini.j2 → roles/php-fpm/templates/php8.2-php.ini.j2
View File

File diff suppressed because it is too large Load Diff

98
roles/php-fpm/templates/php7.4-pool.conf.j2 → roles/php-fpm/templates/php8.2-pool.conf.j2
View File

@ -19,11 +19,16 @@
; Default Value: none ; Default Value: none
;prefix = /path/to/pools/$pool ;prefix = /path/to/pools/$pool
; Unix user/group of processes ; Unix user/group of the child processes. This can be used only if the master
; Note: The user is mandatory. If the group is not set, the default user's group ; process running user is root. It is set after the child process is created.
; will be used. ; The user and group can be specified either by their name or by their numeric
user = nginx ; IDs.
group = nginx ; Note: If the user is root, the executable needs to be started with
; --allow-to-run-as-root option to work.
; Default Values: The user is set to master process running user by default.
; If the group is not set, the user's group is used.
user = {{ webserver }}
group = {{ webserver }}
; The address on which to accept FastCGI requests. ; The address on which to accept FastCGI requests.
; Valid syntaxes are: ; Valid syntaxes are:
@ -35,20 +40,22 @@ group = nginx
; (IPv6 and IPv4-mapped) on a specific port; ; (IPv6 and IPv4-mapped) on a specific port;
; '/path/to/unix/socket' - to listen on a unix socket. ; '/path/to/unix/socket' - to listen on a unix socket.
; Note: This value is mandatory. ; Note: This value is mandatory.
listen = /run/php/php7.4-fpm-{{ domain_name }}.sock listen = /run/php/php8.2-fpm-{{ domain_name }}.sock
; Set listen(2) backlog. ; Set listen(2) backlog.
; Default Value: 511 (-1 on FreeBSD and OpenBSD) ; Default Value: 511 (-1 on Linux, FreeBSD and OpenBSD)
;listen.backlog = 511 ;listen.backlog = 511
; Set permissions for unix socket, if one is used. In Linux, read/write ; Set permissions for unix socket, if one is used. In Linux, read/write
; permissions must be set in order to allow connections from a web server. Many ; permissions must be set in order to allow connections from a web server. Many
; BSD-derived systems allow connections regardless of permissions. ; BSD-derived systems allow connections regardless of permissions. The owner
; Default Values: user and group are set as the running user ; and group can be specified either by name or by their numeric IDs.
; mode is set to 0660 ; Default Values: Owner is set to the master process running user. If the group
listen.owner = nginx ; is not set, the owner's group is used. Mode is set to 0660.
listen.group = nginx listen.owner = {{ webserver }}
listen.group = {{ webserver }}
;listen.mode = 0660 ;listen.mode = 0660
; When POSIX Access Control Lists are supported you can set them using ; When POSIX Access Control Lists are supported you can set them using
; these options, value is a comma separated list of user/group names. ; these options, value is a comma separated list of user/group names.
; When set, listen.owner and listen.group are ignored ; When set, listen.owner and listen.group are ignored
@ -63,6 +70,10 @@ listen.group = nginx
; Default Value: any ; Default Value: any
;listen.allowed_clients = 127.0.0.1 ;listen.allowed_clients = 127.0.0.1
; Set the associated the route table (FIB). FreeBSD only
; Default Value: -1
;listen.setfib = 1
; Specify the nice(2) priority to apply to the pool processes (only if set) ; Specify the nice(2) priority to apply to the pool processes (only if set)
; The value can vary from -19 (highest priority) to 20 (lower priority) ; The value can vary from -19 (highest priority) to 20 (lower priority)
; Note: - It will only work if the FPM master process is launched as root ; Note: - It will only work if the FPM master process is launched as root
@ -71,8 +82,9 @@ listen.group = nginx
; Default Value: no set ; Default Value: no set
; process.priority = -19 ; process.priority = -19
; Set the process dumpable flag (PR_SET_DUMPABLE prctl) even if the process user ; Set the process dumpable flag (PR_SET_DUMPABLE prctl for Linux or
; or group is differrent than the master process user. It allows to create process ; PROC_TRACE_CTL procctl for FreeBSD) even if the process user
; or group is different than the master process user. It allows to create process
; core dump and ptrace the process for the pool user. ; core dump and ptrace the process for the pool user.
; Default Value: no ; Default Value: no
; process.dumpable = yes ; process.dumpable = yes
@ -94,6 +106,8 @@ listen.group = nginx
; state (waiting to process). If the number ; state (waiting to process). If the number
; of 'idle' processes is greater than this ; of 'idle' processes is greater than this
; number then some children will be killed. ; number then some children will be killed.
; pm.max_spawn_rate - the maximum number of rate to spawn child
; processes at once.
; ondemand - no children are created at startup. Children will be forked when ; ondemand - no children are created at startup. Children will be forked when
; new requests will connect. The following parameter are used: ; new requests will connect. The following parameter are used:
; pm.max_children - the maximum number of children that ; pm.max_children - the maximum number of children that
@ -129,6 +143,12 @@ pm.min_spare_servers = 1
; Note: Mandatory when pm is set to 'dynamic' ; Note: Mandatory when pm is set to 'dynamic'
pm.max_spare_servers = 3 pm.max_spare_servers = 3
; The number of rate to spawn child processes at once.
; Note: Used only when pm is set to 'dynamic'
; Note: Mandatory when pm is set to 'dynamic'
; Default Value: 32
;pm.max_spawn_rate = 32
; The number of seconds after which an idle process will be killed. ; The number of seconds after which an idle process will be killed.
; Note: Used only when pm is set to 'ondemand' ; Note: Used only when pm is set to 'ondemand'
; Default Value: 10s ; Default Value: 10s
@ -141,7 +161,7 @@ pm.max_spare_servers = 3
;pm.max_requests = 500 ;pm.max_requests = 500
; The URI to view the FPM status page. If this value is not set, no URI will be ; The URI to view the FPM status page. If this value is not set, no URI will be
; recognized as a status page. It shows the following informations: ; recognized as a status page. It shows the following information:
; pool - the name of the pool; ; pool - the name of the pool;
; process manager - static, dynamic or ondemand; ; process manager - static, dynamic or ondemand;
; start time - the date and time FPM has started; ; start time - the date and time FPM has started;
@ -231,7 +251,7 @@ pm.max_spare_servers = 3
; last request memory: 0 ; last request memory: 0
; ;
; Note: There is a real-time FPM status monitoring sample web page available ; Note: There is a real-time FPM status monitoring sample web page available
; It's available in: /usr/share/php/7.4/fpm/status.html ; It's available in: /usr/share/php/8.2/fpm/status.html
; ;
; Note: The value must start with a leading slash (/). The value can be ; Note: The value must start with a leading slash (/). The value can be
; anything, but it may not be a good idea to use the .php extension or it ; anything, but it may not be a good idea to use the .php extension or it
@ -239,6 +259,22 @@ pm.max_spare_servers = 3
; Default Value: not set ; Default Value: not set
;pm.status_path = /status ;pm.status_path = /status
; The address on which to accept FastCGI status request. This creates a new
; invisible pool that can handle requests independently. This is useful
; if the main pool is busy with long running requests because it is still possible
; to get the status before finishing the long running requests.
;
; Valid syntaxes are:
; 'ip.add.re.ss:port' - to listen on a TCP socket to a specific IPv4 address on
; a specific port;
; '[ip:6:addr:ess]:port' - to listen on a TCP socket to a specific IPv6 address on
; a specific port;
; 'port' - to listen on a TCP socket to all addresses
; (IPv6 and IPv4-mapped) on a specific port;
; '/path/to/unix/socket' - to listen on a unix socket.
; Default Value: value of the listen option
;pm.status_listen = 127.0.0.1:9001
; The ping URI to call the monitoring page of FPM. If this value is not set, no ; The ping URI to call the monitoring page of FPM. If this value is not set, no
; URI will be recognized as a ping page. This could be used to test from outside ; URI will be recognized as a ping page. This could be used to test from outside
; that FPM is alive and responding, or to ; that FPM is alive and responding, or to
@ -271,13 +307,13 @@ pm.max_spare_servers = 3
; %d: time taken to serve the request ; %d: time taken to serve the request
; it can accept the following format: ; it can accept the following format:
; - %{seconds}d (default) ; - %{seconds}d (default)
; - %{miliseconds}d ; - %{milliseconds}d
; - %{mili}d ; - %{milli}d
; - %{microseconds}d ; - %{microseconds}d
; - %{micro}d ; - %{micro}d
; %e: an environment variable (same as $_ENV or $_SERVER) ; %e: an environment variable (same as $_ENV or $_SERVER)
; it must be associated with embraces to specify the name of the env ; it must be associated with embraces to specify the name of the env
; variable. Some exemples: ; variable. Some examples:
; - server specifics like: %{REQUEST_METHOD}e or %{SERVER_PROTOCOL}e ; - server specifics like: %{REQUEST_METHOD}e or %{SERVER_PROTOCOL}e
; - HTTP headers like: %{HTTP_HOST}e or %{HTTP_USER_AGENT}e ; - HTTP headers like: %{HTTP_HOST}e or %{HTTP_USER_AGENT}e
; %f: script filename ; %f: script filename
@ -306,14 +342,30 @@ pm.max_spare_servers = 3
; %s: status (response code) ; %s: status (response code)
; %t: server time the request was received ; %t: server time the request was received
; it can accept a strftime(3) format: ; it can accept a strftime(3) format:
; The strftime(3) format must be encapsuled in a %{<strftime_format>}t tag ; The strftime(3) format must be encapsulated in a %{<strftime_format>}t tag
; %T: time the log has been written (the request has finished) ; %T: time the log has been written (the request has finished)
; it can accept a strftime(3) format: ; it can accept a strftime(3) format:
; The strftime(3) format must be encapsuled in a %{<strftime_format>}t tag ; The strftime(3) format must be encapsulated in a %{<strftime_format>}t tag
; %u: remote user ; %u: remote user
; ;
; Default: "%R - %u %t \"%m %r\" %s" ; Default: "%R - %u %t \"%m %r\" %s"
;access.format = "%R - %u %t \"%m %r%Q%q\" %s %f %{mili}d %{kilo}M %C%%" ;access.format = "%R - %u %t \"%m %r%Q%q\" %s %f %{milli}d %{kilo}M %C%%"
; A list of request_uri values which should be filtered from the access log.
;
; As a security precuation, this setting will be ignored if:
; - the request method is not GET or HEAD; or
; - there is a request body; or
; - there are query parameters; or
; - the response code is outwith the successful range of 200 to 299
;
; Note: The paths are matched against the output of the access.format tag "%r".
; On common configurations, this may look more like SCRIPT_NAME than the
; expected pre-rewrite URI.
;
; Default Value: not set
;access.suppress_path[] = /ping
;access.suppress_path[] = /health_check.php
; The log file for slow requests ; The log file for slow requests
; Default Value: not set ; Default Value: not set
@ -372,7 +424,7 @@ pm.max_spare_servers = 3
; Redirect worker stdout and stderr into main error log. If not set, stdout and ; Redirect worker stdout and stderr into main error log. If not set, stdout and
; stderr will be redirected to /dev/null according to FastCGI specs. ; stderr will be redirected to /dev/null according to FastCGI specs.
; Note: on highloaded environement, this can cause some delay in the page ; Note: on highloaded environment, this can cause some delay in the page
; process time (several ms). ; process time (several ms).
; Default Value: no ; Default Value: no
;catch_workers_output = yes ;catch_workers_output = yes